AhnLab reported malicious Korean Hangul documents themed around COVID-19 small-business relief funds and procurement lures. The documents used malicious PostScript or embedded OLE objects to download or drop DLL payloads, including wscapi.dll and mss.dat. Those DLLs abused WMIC with FTP-hosted XSL scripts to run fileless code in memory, then created scheduled tasks and downloaded additional payloads. The campaign exploited public interest in pandemic-related government support, so users were advised not to open attachments from unclear sources.