Threat Actors Poses as Korean TV Programs’ Writer to Trick Victims and Install Malware

Operation Artemis uses socially engineered emails impersonating Korean broadcasting writers to deliver malicious Hangul (HWP) documents that execute OLE objects and drop executables and version.dll libraries. The campaign employs DLL side-loading (targeting legitimate Sysinternals utilities), multi-layer XOR decryption (including SSE-accelerated routines), steganography, and ultimately deploys the RoKRAT data-stealing payload, maintaining C2 infrastructure on Yandex Cloud with activity between October 2023 and February 2025.