AhnLab ASEC blog (asec.ahnlab.com)
Analysis of Connection Between Malicious Hangul Word Processor Files (.hwp) by Theme · 2020-05-29
excerpt: In the previous post, ASEC shared information on how the titles of the distributed malicious HWP files changed over the course of 3 months. This post is written as a follow-up to the previous post to shed some light on the new information about relationship between title categories. Connection between Theme 1, Theme 2, and […] | attribution sentence: HWP files of this type used the same malicious behavior process that was used in the files before, and we assume that the attacker is KONNI group .