AISEC > Security News > Ai Security > APT37 North Korea New Malware Air-Gapped Networks 2026
February 27, 2026 #ai-security Source: BleepingComputer 3 min read · 662 words

APT37 hackers use new malware to breach air-gapped networks

Хакери APT37 використовують нове шкідливе ПО для проникнення в ізольовані мережі

A New Chapter in North Korean Cyber Tactics

APT37 is at it again. The North Korean threat group, infamous for operations spanning back through the north korea cyber attacks timeline—from the 2014 Sony Pictures breach to the devastating north korea cyber attack in 2022—has just raised the stakes. This time, they're not going after public-facing systems. They're targeting the networks that don't have internet connections at all. The ones that were supposed to be safe.

BleepingComputer reported the discovery of a new malware campaign specifically engineered to breach air-gapped networks. That's a significant tactical shift.

Why does this matter? Because air-gapped systems are typically the crown jewels. They protect classified government data, critical infrastructure controls, and sensitive financial records. The fact that APT37 has developed malware that can jump this gap—using removable drives as a vector—suggests they're not just probing defenses anymore. They're actively targeting the systems organizations thought were unreachable.

The Discovery

Security researchers caught wind of the campaign through threat intelligence monitoring. The malware samples showed clear signatures of APT37's tradecraft: sophisticated design, North Korean infrastructure patterns, and functionality specifically built for environments without network connectivity. What makes this discovery particularly noteworthy is the precision. This wasn't a generic worm. It was purpose-built.

The removable drive angle is clever. USB sticks, external hard drives, SD cards—these are the weak points in air-gapped security models that rely on physical isolation.

Organizations had been assuming removable media was less risky than network-based attacks. APT37 just proved that assumption wrong.

Technical Analysis

Here's what's actually happening under the hood. The malware targets systems that rely on physical media for data transfer—common in defense, government, and research environments where internet connections would compromise security. Once a compromised drive is connected, the malware establishes persistence mechanisms designed to survive reboots and evade detection by traditional antivirus tools.

The exfiltration component is where this gets nasty.

Data stolen from the air-gapped system gets written back to the removable drive, camouflaged within legitimate files. When that drive is later used on a connected system—because it always is eventually—the malware phones home to North Korean command and control infrastructure. It's a dead drop. Tradecraft from the pre-internet era, weaponized for modern infrastructure.

According to BleepingComputer, the malware also includes lateral movement capabilities, allowing it to spread across isolated network segments once it gains initial access. That's six months of potential undetected activity in high-security environments.

Damage Assessment

The real question is: how long has this been running? APT37's campaigns don't typically announce themselves. We're learning about this now because researchers spotted it, but victims might have been compromised for months without knowing. This puts organizations in a terrible position—they've got to assume their most sensitive air-gapped systems might be exposed, and they have no clean way to know for certain without forensic investigation.

The scope remains unclear.

But given APT37's historical targets and the sophistication level, expect government agencies and defense contractors to be the primary victims. The precedent is ugly. Remember the north korean ddos attack waves? This is different. This is precision targeting of systems that cost millions to secure.

Mitigation

First step: treat removable media as a potential attack vector. That means implementing hardware write-blockers for all connections to air-gapped systems. Scan external drives with offline malware detection before connecting them. Better yet, deploy data diodes—one-way networks that allow data out but nothing in.

Second, audit your removable media policies.

If your organization has been allowing USB drives to move freely between air-gapped and connected systems, you've got a problem. Implement strict air-gapped drive pools that never touch the internet. Use approved media only. Log everything.

Third, conduct forensic analysis on any systems that have received external media in the last six months. Look for the telltale signs: unusual file modifications, hidden partitions, or executables in unexpected locations.

Organizations can't make themselves immune to state-sponsored adversaries. But they can make themselves harder targets. APT37 won't stay focused on a network that requires too much effort to maintain. They'll move to the next one.

The clock's ticking for security teams to patch this gap before the next campaign starts.

Read original article →

// FAQ

What is APT37 and why are they targeting air-gapped networks?

APT37 is a North Korean state-sponsored hacking group with a history dating back to 2014 attacks. They're targeting air-gapped networks because they store the most sensitive classified and critical infrastructure data that's normally protected by physical isolation from the internet.

How does the new APT37 malware spread through removable drives?

The malware infects removable media like USB drives and external hard drives, then executes when connected to an air-gapped system. It exfiltrates data by writing it back to the removable drive, disguised as legitimate files, for later retrieval when the drive connects to an internet-connected computer.

What should organizations do to protect air-gapped systems from this threat?

Implement hardware write-blockers on all external connections, scan removable media with offline malware detection, maintain dedicated air-gapped drive pools, establish strict media policies, and conduct forensic analysis on systems that received external drives in recent months.

// RELATED

#ai-security ScarCruft Uses Zoho WorkDrive and USB Malware to Breach Air-Gapped Networks 2026-02-27 #ai-security In Other News: ATT&CK Advisory Council, Russian Cyberattacks Aid Missile Strikes, Predator Bypasses iOS Indicators 2026-02-27 #ai-security Zyxel Patches Critical Vulnerability in Many Device Models 2026-02-26

Concerned about your project's security? Run an automated pentest with AISEC — AI-powered scanner with expert verification. Go to dashboard →