Operation Black Limousine was a late-2018 targeted campaign against South Korean national-security, foreign-affairs, and unification-related communities. The activity was associated with a state-backed group previously known for attacks on a Korean electric utility. Operators sent Korean political and social lures in malicious HWP documents containing embedded EPS exploit code; successful execution contacted command-and-control infrastructure, downloaded another payload, and could enable data theft and remote control.