North Korean APT37 Hackers Weaponize Google Find Hub in Android Data-Wiping Attacks

A sophisticated cyber-espionage campaign orchestrated by the North Korean state-sponsored threat group APT37 (also linked to the KONNI activity cluster) has revealed a destructive new tactic: the abuse of legitimate cloud tools to track and remotely wipe Android devices. Discovered by security researchers at Genians Security Center, the campaign targets high-profile individuals in South Korea—particularly psychological counselors and activists supporting North Korean defectors. Rather than exploiting a software vulnerability, the hackers weaponize Google Find Hub (formerly known as Find My Device) through stolen credentials to cause maximum disruption, isolate targets, and cover their tracks.

Anatomy of the Multi-Stage Attack Chain

The campaign operates as a hybrid threat bridging desktop computers and mobile operating systems, executing a calculated sequence of social engineering, credential harvesting, and cloud-based sabotage:

• Initial Infiltration via Messenger: Attackers approach targets over KakaoTalk—South Korea’s dominant messaging app—often utilizing compromised accounts belonging to trusted contacts or impersonating government agencies.
• Malicious File Delivery: Targets are lured into opening a malicious file disguised as a benign utility, such as a "stress relief program" (e.g., a digitally signed MSI installer package).
• Deploying Remote Access Trojans (RATs): Once executed, the installer runs background batch and AutoIt scripts that deploy potent modular Trojans, including RemcosRAT, QuasarRAT, and RftRAT. These grants attackers full remote access, keylogging capabilities, and credential-harvesting tools.

Weaponizing Google Find Hub for Remote Wiping

Once the threat actors successfully harvest the victim's credentials for major cloud services (including Google and Naver accounts) from the infected Windows PC, they pivot to cloud abuse:

• GPS Tracking: The attackers log into the victim's Google account and open Google Find Hub to pinpoint the exact real-time geographic location of all registered Android devices. They use this data strategically, often waiting until the target is out and away from their home or office.
• Remote Factory Resets: Through the Find Hub dashboard, the hackers trigger remote factory reset commands. Because this is a core security feature designed to protect lost or stolen hardware, it instantly wipes all local data from the phone or tablet.
• Repeated Destruction: Attackers have been observed executing the wipe command multiple times to ensure total data corruption and severely delay recovery operations.

Why Do Hackers Wipe the Phone?

While data destruction is typically associated with ransomware, APT37 uses remote wiping as a tactical smoke screen for espionage:

• Isolating the Victim: Wiping the device cuts off real-time mobile security alerts, two-factor authentication (2FA) prompts, and emergency communications.
• Silencing Traces: It deletes local forensic artifacts, application data, and notification logs that could expose the compromise.
• Lateral Movement via KakaoTalk: With mobile alerts silenced and the target cut off, the attackers hijack the victim's active KakaoTalk PC session (left open on the compromised desktop) to automatically broadcast malicious files to the victim's professional and personal contacts, spreading the infection further.

Mitigation and Defense Strategies

Because this attack does not rely on an operating system bug or zero-day flaw in Google Find Hub—instead leveraging a trusted administrative feature via stolen credentials—defense relies heavily on endpoint hygiene and robust account security:

• Enforce Multi-Factor Authentication (MFA): Implement hardware-backed or phishing-resistant MFA across all critical Google and corporate accounts to block unauthorized web logins even if passwords are leaked. High-risk users should consider enrolling in Google’s Advanced Protection Program.
• Exercise Extreme Caution with Files: Never execute unsolicited software, scripts, or installer attachments sent via messenger applications—even if they originate from known or trusted contacts whose accounts may already be compromised.
• Endpoint Protection: Deploy modern Endpoint Detection and Response (EDR) solutions capable of intercepting unauthorized script execution (such as AutoIt loaders) and blocking well-known RAT variants before credentials can be stolen.

Conclusion

The APT37 Find Hub abuse campaign highlights an evolving trend in advanced cyber operations: threat actors no longer need to hack mobile operating systems directly to compromise smartphones. By bridging desktop malware infections with the legitimate administrative capabilities of cloud tools, state-sponsored groups can turn a user's own ecosystem against them, transforming safety utilities into digital weapons.