NarwhalRAT arrives as a fake Microsoft alert and a shortcut file, and the IoC list is 11 long

Genians Security Center says it has uncovered a North Korean cyberespionage campaign that deploys NarwhalRAT, a Python-based remote access trojan built for data theft ^[1]. The delivery chain is spear-phishing email posing as a Microsoft account security alert, with an attachment that runs a malicious shortcut file and installs the malware quietly ^[2][3]. Nothing in that description requires an exploit, which means the controls that stop it are the ones most organisations already own.

Once running, according to Genians, NarwhalRAT logs keystrokes, captures the screen, harvests files from USB drives, and executes commands remotely ^[4]. Genians attributes the campaign to APT37, a state-sponsored group it says has been active since at least 2012 ^[5]. The USB harvesting is the part worth pausing on: it implies collection against machines that may not be continuously connected, and it changes the evidence picture, because removable media rarely gets the same logging treatment as endpoints.

The indicator set is unusually tractable. Genians published 11 network IoCs, five domains and six IP addresses ^[6][7], which is the whole of the public network surface for now ^[8]. Eleven is a number a small team can push into DNS logging, proxy denylists and SIEM watchlists in an afternoon rather than a sprint. The values themselves are in the Genians post, not in the WhoisXML API summary of it ^[9], and that summary's own footnote to the Genians report is mistyped as "ttps://" rather than a working link ^[10], so budget a minute to find the primary source.

WhoisXML API says it ran the domains through a legitimacy check and confirmed none of the domain IoCs were owned by legitimate entities, then analysed all 11 to map the campaign's wider footprint ^[11][12]. Its stated process was a domain legitimacy check, IP geolocation and traffic analysis, WHOIS and DNS history analysis on the domains, and then email-connected, IP-connected and string-connected domain discovery ^[13]. The headline categories it advertises are email-connected domains, potential victim IP addresses, IP-connected domains and string-connected domains ^[14]. No counts are attached to any of those categories in the public write-up, and the rest sits behind a sample download or a sales conversation ^[15][16]. Treat the pivot findings as a marketing claim about a report you have not read, and the eleven original indicators as the operational content.

What to watch. Whether Genians follows with file-level indicators, since a Python RAT delivered by shortcut file leaves host artefacts that network blocks will not catch ^[1][3]. Whether the expanded infrastructure, especially the "potential victim IP addresses" WhoisXML says it identified, reaches defenders openly or stays gated ^[14][15]. And whether the five domains rotate, which is the usual answer to a published list this short ^[7].