Operation Anonymous Phantom was an intrusion cluster that emerged in early 2016 during a period of targeted attacks affecting South Korea’s defense-related environment. Its activity became less frequent after autumn 2016, but investigators identified the cluster in an attack on an energy-related research institute in spring 2017. Anonymous Phantom was tracked separately from the contemporaneous Icefog, Red Dot, and Ghost Rifle operations.