Operation Daybreak was a ScarCruft campaign launched around March 2016 to compromise high-profile targets through spear-phishing links leading to exploit code on hacked websites. It used a previously unknown Adobe Flash Player vulnerability and may also have deployed a then-zero-day Windows vulnerability. More than two dozen victims were observed, while ScarCruft’s broader victim footprint included organizations or individuals in Russia, Nepal, South Korea, China, India, Kuwait, and Romania; shared infrastructure and targeting supported the attribution.