Operation Ghost Union is a December 2019 Kimsuky campaign against South Korean institutions and companies that combined Kimsuky-developed malware with tooling associated with Andariel. Spearphishing emails carried malicious macro-enabled spreadsheet attachments and initiated a multistage chain of backdoors, system reconnaissance, keylogging, privilege-control bypass, and remote-desktop capabilities. The operation collected host information and keystrokes for exfiltration, while its unusual reuse of another North Korean group’s malware was the defining feature behind the Ghost Union name.