Operation GhostPuppet was a targeted campaign identified in August 2018 that used a malicious Hangul Word Processor document styled as a notice about an alleged financial-law violation. The document embedded compressed PostScript that exploited the GhostScript engine, decoded shellcode, injected a thread into the Windows shell, and downloaded a remote-access payload. Its use of the Korean HWP format suggests a focus on users of software common in South Korean government environments, while the final malware provided command-and-control and remote system control.