ESRC reports a Kimsuky watering-hole attack that abused an application document for a university-hosted unification education program. Visitors seeking the application could download a malicious HWP file whose visible link text triggered an embedded OLE object, document.bat, rather than an external URL. The batch file opened a decoy document, renamed dropped files under temporary and public music paths, configured persistence through scheduled execution, and prepared additional C2 download activity, making the campaign a targeted lure against people interested in inter-Korean or unification topics.