Operation GoldGoblin is a 2023 Lazarus Group campaign against South Korean organizations that selectively compromised victims through watering holes and vulnerabilities in widely deployed security software. Operators stole source code from software developers, used it to develop exploitation capability, injected malicious scripts into news sites, and abused hosting and groupware infrastructure for command and control. The campaign could spread in a domino effect as personnel at other media organizations visited compromised reporting sites, while masquerading and trusted domestic infrastructure helped the malware blend into normal enterprise activity.