Operation HighExpert was a Rocket Man campaign tracked across activity from 2018 into March 2019 and attributed to Geumseong121. The actor targeted South Korean users through malicious HWP and Excel documents, including payment-receipt lures, while document metadata repeatedly exposed the HighExpert account name. Earlier spreadsheets used external data links and obfuscated PowerShell commands to download malware; the March 2019 chain returned to an OLE-enabled HWP document that dropped a disguised executable. Reused infrastructure, development paths, and document artifacts linked the variants to the broader Rocket Man activity cluster.