Operation Golden Bird was a March 2019 spear-phishing campaign against South Koreans working on North Korea-related diplomacy, security, unification, defense, defector, and civil-society issues. It was attributed to a state-sponsored actor associated with the continuing Rocket Man campaign and assessed to overlap with a group linked to the 2014 Korea Hydro and Nuclear Power attack. Password-protected archives and forwarded-email pretexts delivered a benign-looking HWP résumé containing a hyperlink that launched a companion executable disguised as a screen saver. Reused infrastructure and operational artifacts connected the activity to earlier Rocket Man operations.