Operation Covert Stalker comprises 17 months of persistent Kimsuky activity tracked from 2022 into 2023 against individuals and organizations involved in North Korea, politics, diplomacy, and security. Its objective was to steal email accounts, sensitive documents, and other information through credential-phishing messages, malicious attachments, exploitation of vulnerable Windows and web systems, and sustained command-and-control operations. Operators established persistence with new remote-access accounts and tools such as RDP Wrapper, Quasar RAT, Ammyy RAT, AnyDesk, and TeamViewer, reflecting a long-running espionage effort rather than a single intrusion.