Flashpoint reported that KrCERT warned on January 31, 2018 about Adobe Flash CVE-2018-4878 affecting Flash Player ActiveX 28.0.0.137 and earlier. A South Korean researcher said the exploit was being used against South Korean entities in a Korean cosmetics-themed Excel document and claimed North Korean actor involvement, but Flashpoint noted that the claim was not independently corroborated. Debug metadata suggested exploitation may have started as early as November 14, 2017, with the builder path F:\work\flash\obfuscation\loadswf\src. The archive also preserves detection material, including MD5s, two C2 URLs under Korean domains, and a YARA rule for Office-embedded Flash payloads.