BlackBanner was a 2019 spear-phishing operation attributed to the Geumseong121 threat group and aimed primarily at people active in organizations concerned with North Korea. The campaign sent minimally worded emails with malicious HWP attachments that exploited a patched document vulnerability, then downloaded a 32-bit executable disguised as a GIF image. The payload used a compromised South Korean website for command-and-control and reused infrastructure, code, and other tradecraft associated with the group’s Rocket Man, Golden Bird, and High Expert activity.