Skip to content
brandefense.io
Request A Demo
UnclassifiedUnknown

Pat Bear, APT-C-37

Pat Bear, APT-C-37 is a Syria-attributed threat actor group, tracked by Brandefense.

Also known as
  • Pat Bear
  • APT-C-37
  • Racquet Bear
Request IOC feedRequest ATT&CK export
Origin
Syria
Techniques
0
Exploited CVEs
No CVE data
Record updated

Vulnerabilities Linked To Their Tools.

Browse Vulnerability Intelligence →
CVE-2025-21204Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.high

Arsenal · Malware And Tools.

  • DroidJackmalware
  • njRATmalware
  • SpyNotemalware

About Pat Bear, APT-C-37.

A subgroup of 'Syrian Electronic Army (SEA), Deadeye Jackal'. (Qihoo 360) Since October 2015, the Pat Bear Organization (APT-C-37) has launched a well-organized, targeted and persistent attack against the “Islamic State”. Watering hole was used to delivery sample in this attack. The malicious samples were mainly disguised as chat software and some common software in specific fields. This Trojan has many functions such as stealing messages, contacts, WhatsApp and Telegram data, and uploading files using FTP. After reversing and correlation, we found that there is a strong correlation between the Pat Bear Organization and the Golden Rat issue, so this attack activity belongs to another branch of the Syrian Electronic Army.

Last updated Sep 11, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.