ReversingLabs analyzed a PoorWeb campaign built around malicious Hangul Word Processor documents aimed at a victim organization and related Korean-language HWP attacks seen from March 2019 through September 2020. The initial documents abused HWP compound-file streams, including HwpSummaryInformation metadata such as the “HighExpert” marker and BinData streams containing encapsulated PostScript loaders. The EPS content used XOR-encoded shellcode loaders that ultimately led to PoorWeb-family PE payloads, while related samples reused loader templates and overlapping document structures. The report’s value is in separating this PoorWeb delivery chain from other campaigns by comparing HWP metadata, shellcode behavior, YARA-detectable structures, and payload relationships.