Operation BattleCruiser is a Lazarus Group campaign observed in 2018 against selected South Korean and overseas targets, including defense, security, public-sector, academic, financial, and cryptocurrency-related organizations. It used spearphishing documents exploiting HWP or Microsoft Office vulnerabilities to retrieve platform-specific DLL payloads disguised with media or archive-like extensions. Recurrent internal filenames, shared communications code, Korean-language resources, and Manuscrypt-family payloads linked multiple waves, including renewed activity in October 2018 that delivered encoded backdoors from compromised websites.