ESRC analyzed Operation Ghost Puppet, an August 2018 campaign using a malicious HWP document titled as a notice about illegal fund-raising activity. The document embedded compressed PostScript under HWP BinData and abused GhostScript processing to decode shellcode, inject into explorer.exe, and download gcoin2.swf from tpddata.com. The payload provided remote-control functionality and contacted C2 paths on pakteb.com, nuokejs.com, and qdbazaar.com. The source highlights targeting logic around Korean HWP documents, which are commonly used in South Korean public-sector environments, and compares metadata, XOR decoding structures, and command strings with earlier Korean intrusion cases.