2022-04-27_ìì_ëì_ë³ê³ìAPT37-GOLDBACKDOOR.pdf (1 MB)

Hauri reported an APT37 spear-phishing campaign targeting journalists who cover North Korea-related issues. The attack used a large LNK file named "Kang Min-chol Edits 2.lnk" that hid PowerShell commands behind junk data and extracted a decoy Word document to appear legitimate. The decoded PowerShell reached an attacker-controlled OneDrive resource through Microsoft Graph API to retrieve encrypted shellcode, enabling a fileless Goldbackdoor infection chain.