A spear-phishing email containing a malicious HWP attachment was sent to an individual associated with a South Korean think tank. The email originated from a known malicious IP address linked to Kimsuky APT group.