McAfee reported Operation Sharpshooter as a global campaign against nuclear, defense, energy, and financial organizations, with many observed Rising Sun infections in the United States and defense or government-related targets. The activity masqueraded as legitimate job recruitment and used weaponized documents or macros to download an in-memory next stage. Rising Sun gathered host and network intelligence and exfiltrated victim data to attacker C2; its framework reused source code from Lazarus Group's 2015 Duuzer backdoor, but McAfee warned the links could be false flags and did not make a final attribution. The report supports detection for multi-stage reconnaissance, remote access, and C2 patterns tied to job-themed payload delivery.