疑似“Group 123”APT团伙利用HWP软件未公开漏洞的定向攻击分析
2018-11-08 • Qihoo360 • Analysis of a targeted attack by suspected Group 123 APT using an undisclosed HWP software vulnerability •
https://ti.360.net/blog/articles/analysis-of-group123-sample-with-hwp-exploitkit/
QiAnXin/360 analyzes a suspected Group 123 APT attack sample targeting Hancom Office HWP users in South Korea. The report says the HWP sample exploited an undisclosed Hancom Office issue related to Ghostscript sandbox handling to execute malicious code, with older Hancom Office versions remaining exposed. It is useful for defenders tracking APT37/Group123 document exploitation, Korean-language software targeting, and low-detection HWP exploit delivery.