hwpole_202206.pdf (2 MB)

Somansa reported continued North Korea-attributed abuse of HWP OLE objects against South Korean users even after Microsoft patched CVE-2022-30190. The analyzed lures included broadcast invitation requests, surveys for North Korean defector advisers, inter-Korean affairs documents, construction-activity documents, disaster-relief consent forms, foreign-ministry inspection files, and forum payment forms. The report says malicious HWP documents are especially effective in South Korea because HWP is widely used by public agencies, schools, and related businesses, with diplomats, security officials, and North Korea-related personnel frequently targeted.