“Casting Call” for Malware: APT37 Poses as TV Writers to Hack Targets

APT37, also known as Reaper or Ricochet Chollima, is linked to a campaign that masquerades as TV production staff to slip malware past defenses, according to Genians Security Center. The Artemis operation begins with a deceptive email in which the threat actor impersonates a writer for Korean TV programmes and reaches out to targets for casting or interview arrangements.

The attackers use a short self-introduction and legitimate-looking instructions to build trust before delivering a malicious HWP (Hangul Word Processor) document, then employ a masquerading technique to launch a legitimate process first to bypass antivirus scans. The multi-stage attack relies on DLL side-loading and executing the payload within the context of a trusted application, piggybacking on authorised system processes.

Forensic analysis traces the campaign through a Yandex Cloud login account, tanessha[.]samuel, linked to the pCloud registration account and both created on 19 October 2023, suggesting the actor operates multiple cloud infrastructures under a single identifier. Real-time monitoring through an EDR solution is recommended to identify the subtle execution flow of the Artemis campaign, which relies on social engineering and targeted interactions rather than generic phishing.