Smoke Screen.pdf

This report analyzes 'Campaign Smoke Screen', a targeted APT campaign against Korean and U.S. individuals using spear-phishing with malicious HWP/DOC documents that exploit document vulnerabilities to download HTA/VBS and PowerShell payloads (including a keylogger) which collect system information and upload logs to C2 servers; the report provides IOCs (domains, IP 110.4.107.244 and 192.186.142.74, multiple MD5s), demonstrates reuse of metadata/accounts (e.g., 'Tom', 'windowsmb', 'JamFedura'), maps actor personas across social platforms, and assesses the operation as likely state‑sponsored with links to prior campaigns.