Operation Cobra Venom was a large spear-phishing attack conducted on January 7, 2019 against approximately 77 journalists covering South Korea’s Ministry of Unification and related beats. The activity was associated with a state-sponsored group and showed fluent Korean usage. Password-protected archives contained legitimate decoy documents and an executable disguised as an HWP file through icon spoofing, whitespace, and a double extension. Running it displayed a benign document while Windows Script Files retrieved, decoded, and executed additional payloads from cloud-hosted and attacker-controlled infrastructure, with the chain designed to reduce obvious forensic traces.