ASEC correlates several malicious Hangul document clusters using COVID-19, real estate, and renewable-energy themes and concludes they likely came from the same maker group based on overlapping EPS and payload characteristics. The documents abuse Encapsulated PostScript content to execute shellcode, create or run VBS in some variants, and download additional malicious files from attacker-controlled URLs. A related Koni-style set uses XOR-encoded shellcode that runs in memory rather than writing the downloader shellcode to disk. The report provides multiple download and C2 URLs and hashes, supporting detection for malicious HWP delivery chains that rely on social-engineered document titles.