A growing threat organization believed to be tied to the North Korean government has launched a malicious campaign targeting journalists with the goal of extracting sensitive information from their devices. APT37, otherwise tracked as InkySquid, Reaper, and ScarCruft, is a state-backed espionage organization that has been active since 2012. APT37 primarily targets entities within South Korea but has gone as far as Japan, Romania, China, and other surrounding Middle Eastern countries. In this campaign, APT37 threat actors impersonated NK News and disseminated the “Goldbackdoor” malware to journalists using a spear-phishing campaign. Goldbackdoor is a multi-stage program that first executes a decoy document, that tests for security protections, followed by a PowerShell script that downloads an XOR payload and executes it on the system. Goldbackdoor allows threat actors access to execute arbitrary commands on the system, conduct file collection, log keystrokes, and remotely purge itself from the system. As this campaign is still ongoing, CTIX analysts continue to urge users to verify all email correspondence prior to executing any file downloads or visiting any embedded links to lessen the chance for threat actor compromise.