Threat Actors Poses as Korean TV Programs’ Writer to Trick Victims and Install Malware

Cybersecurity researchers have identified a campaign where threat actors impersonate writers from major Korean broadcasting networks to distribute malicious documents.

The operation, known as Operation Artemis, involves social engineering tactics that use trusted media personalities to establish credibility with potential victims before delivering harmful payloads.

The campaign employs a multi-stage attack strategy that combines deception with advanced technical evasion methods. Threat actors contact victims via email communications disguised as legitimate interview requests or professional collaboration opportunities.

The attackers present themselves as established writers from recognized Korean television programs, using authentic-sounding proposals related to North Korean affairs and human rights issues to align with target interests.

Genians analysts identified that the malware emerges from malicious HWP documents—Hangul Word Processor files that serve as the standard document format in South Korea. These files arrive as attachments masked as interview questionnaires or event guide materials. Once opened, the infection chain initiates silently in the background.

The attack leverages DLL side-loading , a technique where legitimate system utilities from Microsoft Sysinternals are used to load malicious DLL files instead of legitimate ones. Specifically, the malware creates files named version.dll that get loaded by legitimate processes like vhelp.exe and mhelp.exe.

The DLL file employs encryption layers using XOR operations to conceal its purpose. Depending on the target system's capabilities, the malware selects between standard byte-wise XOR decryption or high-speed SSE (Streaming SIMD Extensions) methods.

The malware deploys RoKRAT, a data-stealing tool. The infection chain includes OLE object execution within HWP documents, followed by the deployment of executable files and malicious DLLs. The payload undergoes XOR decryption stages before activating as shellcode.

Forensic analysis revealed command-and-control infrastructure through Yandex Cloud services in Russia, with account tokens indicating operational capability from October 2023 to February 2025.

Detection requires behavioral monitoring through Endpoint Detection and Response solutions rather than conventional file scanning. Security teams should monitor abnormal DLL loading, suspicious child processes from legitimate executables, and outbound connections to cloud infrastructure following document execution.

The campaign highlights how threat actors continue refining methodologies to exploit trust and detection gaps.

Based on reporting by Cyber Security News.