AhnLab ASEC observed document malware distributed to people in the security field under the guise of a manuscript solicitation letter. Opening the Word document used template injection through an external object to download and run an additional malicious macro document from attacker C2 infrastructure, while also opening a benign Korean decoy document. The follow-on script exfiltrated the user’s Downloads-folder path and installed persistence through a scheduled task, and it collected installed antivirus information. ASEC linked the C2 IP 112.175.85.243 to phishing domains previously seen in a fake Kakao login-page campaign, suggesting the same operator; listed indicators include lifehelper[.]kr paths and MD5 hashes for the downloader documents and VBS components.