APT37 Uses Malicious HWP Documents and DLL Side-Loading in Operation Artemis
Summary
Genians analyzes an APT37 campaign that used spear-phishing HWP documents, OLE objects, DLL side-loading and RoKRAT payloads, with Yandex Cloud infrastructure for C2. The report details the attack chain and recommends behavior-based EDR monitoring.
Key points
- APT37 targeted victims with HWP documents delivered through spear-phishing, including invitations and interview requests impersonating credible people.
- Embedded OLE objects prompted execution and created a malicious version.dll alongside legitimate Sysinternals VolumeId utilities, which loaded it through DLL side-loading.
- The DLL used multiple XOR decryption stages to conceal a RoKRAT payload; samples shared a PDB string.
- The campaign used Yandex Cloud for C2, and the report links a Yandex account to a pCloud account through a shared identifier and matching registration date.
- The analysis covers activity from August to November and describes repeated use of steganography, social engineering and DLL side-loading.
- Genians recommends monitoring abnormal DLL loading, HWP-spawned processes, temporary-folder file drops and suspicious cloud communications with behavior-focused EDR.
Article Details
- Attack Vectors
- Spear-phishing HWP documents impersonating conference invitations, interview requests, or event guides; embedded OLE objects were presented as hyperlinks to induce execution.
- DLL side-loading: a malicious version.dll was placed alongside legitimate Sysinternals VolumeId utilities, which loaded it.
- Steganography concealed RoKRAT payloads in image files, followed by multiple XOR-decryption stages before shellcode and the final payload were activated.
- The report identifies Yandex Cloud as C2 infrastructure and describes cloud storage services being used for command delivery, result collection, and payload hosting.
- Defensive Notes
- Use EDR to monitor legitimate processes loading DLLs from abnormal paths, signature mismatches, file drops, and temporary-folder DLL loading.
- Monitor child processes spawned by HWP, including rundll32.exe, cmd.exe, and powershell.exe, and investigate abnormal execution chains.
- Correlate process activity with subsequent network communications, including anomalous or out-of-hours connections to cloud services.
- Use behavioral detection and attack-storyline analysis to trace the execution chain and support prompt blocking, isolation, and forensic investigation.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
tanessha[.]samuel@gmail[.]com | pCloud registration email that the report links to the actor's cloud infrastructure and C2 activity. | |
| MD5 | 17171c644307b17d231ad404e25f08b1 | MD5 hash listed in the article's indicators of compromise for the Operation Artemis threat. |
| MD5 | 2f3dff7779795fc01291b0a31d723aca | MD5 hash listed in the article's indicators of compromise for the Operation Artemis threat. |
| MD5 | 31662a24560b3fe1f34f0733e65509ff | MD5 hash listed in the article's indicators of compromise for the Operation Artemis threat. |
| MD5 | 7e8c24bb3b50d68227ff2b7193d548dd | MD5 hash listed in the article's indicators of compromise for the Operation Artemis threat. |
| MD5 | 8e4a99315a3ef443928ef25d90f84a09 | MD5 hash listed in the article's indicators of compromise for the Operation Artemis threat. |
| MD5 | a196fb11a423076f66f5e4b2d02813a9 | MD5 hash listed in the article's indicators of compromise for the Operation Artemis threat. |
| MD5 | ad3433f5f64abdec7868a52341f14196 | MD5 hash listed in the article's indicators of compromise for the Operation Artemis threat. |
| MD5 | c0cac70c93d213d113001e3410c24fd2 | MD5 hash listed in the article's indicators of compromise for the Operation Artemis threat. |
| MD5 | d287dcaeaf17c9dae8a253994502ee58 | MD5 hash listed in the article's indicators of compromise for the Operation Artemis threat. |
| MD5 | d2b2c6646535a62e4c005613d6a036f0 | MD5 hash listed in the article's indicators of compromise for the Operation Artemis threat. |
| MD5 | e726b59f96ab8360f323469d72b8b617 | MD5 hash listed in the article's indicators of compromise for the Operation Artemis threat. |
| MD5 | ea95109b608841d2f99a25bd2646ff43 | MD5 hash listed in the article's indicators of compromise for the Operation Artemis threat. |
| MD5 | f13a4834e3e1613857b84a1203e2e182 | MD5 hash listed in the article's indicators of compromise for the Operation Artemis threat. |
| MD5 | f3603f68aadc8bc1ea8939132f0d5252 | MD5 hash listed in the article's indicators of compromise for the Operation Artemis threat. |
MITRE ATT&CK
T1027.003 · SteganographyThe actor used steganography to conceal RoKRAT payloads in image files.T1102.002 · Bidirectional CommunicationThe report describes cloud services, including Yandex Cloud, being used as bidirectional C2 channels for command delivery and result collection.T1140 · Deobfuscate/Decode Files or InformationThe DLL and subsequent payload stages used XOR decryption to reveal payloads and shellcode.T1204.002 · Malicious FileThe attack chain relied on recipients opening the malicious HWP document and activating its embedded OLE object.T1566.001 · Spearphishing AttachmentThe actor delivered malicious HWP documents as spear-phishing attachments disguised as invitations, interview requests, and event documents.T1574.002 · DLL Side-LoadingLegitimate Sysinternals VolumeId executables loaded a malicious version.dll placed in the same directory.
Threat Actors
Malware
Vendors
GeniansGenians Security Center identified the “Artemis” campaign conducted by the APT37 group.MicrosoftDuring the side-loading stage, a system utility from Microsoft Sysinternals was abused.pCloudadvanced its strategy of abusing legitimate commercial cloud services such as Dropbox, OneDrive, pCloud, and Yandex Cloud to disguise C2 traffic as normal communication.YandexAnalysis showed that the C2 infrastructure identified in Operation Artemis relied on Russia-based Yandex Cloud as a core node.
Products
Dropboxthe group has continually advanced its strategy of abusing legitimate commercial cloud services such as Dropbox, OneDrive, pCloud, and Yandex Cloud to disguise C2 traffic as normal communication.Genian EDRGenian EDR can effectively detect the DLL sideloading technique leveraged by APT37 through XBA-based detection rules, ensuring that no detection gaps.HWPThe attacker distributes a malicious HWP file disguised as a pre-interview questionnaire or event guide document.Microsoft OneDrivehas continually advanced its strategy of abusing legitimate commercial cloud services such as Dropbox, OneDrive, pCloud, and Yandex Cloud to disguise C2 traffic as normal communication.pCloudadvanced its strategy of abusing legitimate commercial cloud services such as Dropbox, OneDrive, pCloud, and Yandex Cloud to disguise C2 traffic as normal communication.Yandex CloudAnalysis showed that the C2 infrastructure identified in Operation Artemis relied on Russia-based Yandex Cloud as a core node.
Tools
Countries
North KoreaOn October 27, 38 North, a U.S.-based media outlet specializing in North Korea, published a report titled “HWP as an Attack Surface: What Hancom's Hangul Word Processor Means for South Korea's Cyber Posture as a USRussiaAnalysis showed that the C2 infrastructure identified in Operation Artemis relied on Russia-based Yandex Cloud as a core node.South Koreapublished a report titled “HWP as an Attack Surface: What Hancom's Hangul Word Processor Means for South Korea's Cyber Posture as a US Ally.”SwitzerlandIn addition, the actor’s choice to register with Russia-based Yandex and Switzerland-based pCloud at the same time suggests a strategy of evasion and concealment through geographic and legal jurisdictional separation,
Industries
GovernmentThe report notes that North Korean cyber operators have repeatedly exploited this format in their attempts to infiltrate government, military, and key industrial networks in South Korea.IndustrialThe report notes that North Korean cyber operators have repeatedly exploited this format in their attempts to infiltrate government, military, and key industrial networks in South Korea.MediaOn October 27, 38 North, a U.S.-based media outlet specializing in North Korea, published a report titled “HWP as an Attack Surface: What Hancom's Hangul Word Processor Means for South Korea's Cyber Posture as a USMilitaryThe report notes that North Korean cyber operators have repeatedly exploited this format in their attempts to infiltrate government, military, and key industrial networks in South Korea.