Operation Printing Paper was an April 2019 spear-phishing campaign attributed to the state-backed Geumseong121 group. Attackers weaponized an HWP document with content copied from a real South Korean academic-conference notice and embedded PostScript code that created startup scripts. The infection assembled and executed a payload disguised as a Korean printer component, using split files and printer-themed names to conceal execution and establish access on the targeted Windows host.