Operation BlueSky was a 2019 spear-phishing campaign associated with the Korean-speaking Konni threat group. It used malicious Word documents, often themed around cryptocurrency or finance, that prompted victims to enable macros and then downloaded additional stages from infrastructure impersonating a well-known Korean portal. The chain used system utilities to retrieve and decode staged content, installed an executable payload, and ultimately deployed the Amadey botnet malware. Reuse of the BlueSky document-author account linked the activity to the earlier Hunter Adonis campaign, although overlap with other actors’ material remained unresolved.