Loading story…
Trend Micro reported that attackers used malicious Hangul Word Processor (HWP) document attachments to abuse embedded PostScript content and trigger code execution on victim systems. The activity relied on weaponized HWP files delivered as attachments, taking advantage of how the software handled PostScript data to run attacker-controlled code when the document was opened.
The report highlights a document-based intrusion technique aimed at users and organizations that rely on HWP, a format widely used in South Korea. By embedding harmful PostScript in seemingly legitimate files, attackers turned routine email attachments into an infection vector, underscoring the risk posed by targeted phishing campaigns and the need to scrutinize HWP attachments as potentially dangerous active content.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Trend Micro published research describing malicious email attachments that abused Hangul Word Processor and PostScript formats. The reference does not provide earlier dated events, so the publication itself is the only distinct event that can be placed on the timeline from the available content.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported multiple spearphishing campaigns using malicious **Hangul Word Processor (HWP)** files themed around North Korea, peace, reunification, and event questionnaires to target Korean-speaking users. The lures included files such as `1_참가신청서.hwp` and `질의서-12월15일.hwp`, some masquerading as legitimate government or broadcast-related documents. In several cases, the documents abused **OLE** functionality rather than a software exploit, relying on user interaction with a transparent object or hyperlink to extract and launch an embedded executable such as `HncApp.exe` from the Temp directory. The malware then executed staged payloads, established persistence by copying itself into public document paths and creating **Run** registry entries, and contacted command-and-control infrastructure including `price365.co[.]kr/abbi/json/ps/aa.php` and `yegip.kr` for follow-on instructions. Analysts said one sample used batch files including `TroubleShooter.bat` and `Diagnostics.bat`, while others decoded additional payloads with XOR and loaded secondary malware into memory for remote control, information theft, and possible screenshot exfiltration. Researchers linked the infrastructure and tradecraft to previously reported **North Korea-linked APT** activity, noting that the technique abuses legitimate document behavior and can remain effective even on fully patched systems.
Aug 15, 2026
North Korean threat actor **APT37** targeted South Korean users through multiple intrusion chains that combined malicious documents with Internet Explorer engine exploitation. Google linked the group to **`CVE-2022-41128`**, a type confusion flaw in **`jscript9.dll`** that enabled arbitrary code execution after victims opened Office lures themed around the Itaewon tragedy; the documents fetched remote content that was rendered through Internet Explorer, validated infections with cookies, reported to command-and-control servers, and then downloaded follow-on payloads while clearing browser artifacts. Genian later reported a sustained 2023 campaign in which APT37 used **HWP**, **HWPX**, **LNK**, **DOCX**, and **XLSX** files, with embedded **OLE** objects in Korean document formats triggering connections to attacker-controlled infrastructure and reflecting techniques tied to the earlier Internet Explorer exploit activity. AhnLab and South Korea’s **NCSC** also disclosed a separate APT37 operation exploiting **`CVE-2024-38178`**, another **`jscript9.dll`** type confusion vulnerability in the legacy Internet Explorer engine. In that campaign, attackers compromised a domestic advertising agency server and weaponized toast-style ad software that still depended on Internet Explorer, creating a **zero-click** infection path in which malicious ad content was automatically downloaded and rendered without user interaction. The resulting malware provided remote command execution and other post-compromise capabilities, underscoring APT37’s continued focus on South Korean targets and its repeated abuse of deprecated browser components and document-based lures to gain code execution.
Aug 15, 2026
Microsoft documented **CVE-2021-40444** as a remote code execution flaw in the MSHTML engine that could be triggered through specially crafted Microsoft Office documents, and security reporting tied the issue to attachment-based phishing campaigns. MITRE ATT&CK maps this activity to **`T1566.001` Spearphishing Attachment**, a technique widely used by both state-backed and criminal actors to gain initial access through Word, Excel, RTF, PDF, archive, and shortcut files sent by email. Security telemetry and malware analysis showed how the technique translated into real-world intrusion activity. A suspicious Word document sample analyzed in ANY.RUN and Trustwave reporting on a trojanized OneNote lure illustrate the broader pattern of weaponized Office attachments being used to execute payloads such as **FormBook**. Splunk also published detection guidance for spotting Office processes loading **`mshtml.dll`**, noting that such module loads can indicate exploitation of **CVE-2021-40444** and may precede arbitrary code execution, data theft, or deeper compromise.
Aug 15, 2026