A group suspected of North Korean activity repeatedly sent malicious HWP documents to cryptocurrency exchange personnel after June 1, 2018, using decoys tied to cryptocurrency regulation, wallet development, and job-application themes. The documents used an EPS exploit in HWP to deliver malware that could contact C2 servers, send victim information, and download and execute additional payloads. The source links the malware to the latest Lazarus Group variant and compares it with Hidden Cobra activity against Turkish financial organizations that used Bankshot-themed cryptocurrency lures. Shared tradecraft included explorer.exe injection, similar additional-download logic, matching decryption keys, comparable C2 communication protocols, and RAT capabilities for system discovery, file listing, process execution, drive enumeration, and process collection.