Operation Kabar Cobra is AhnLab’s name for a series of targeted attacks observed around late 2018 and January 2019 and assessed to have been led by Kimsuky. The activity targeted military-related and media recipients, including journalists covering South Korea’s Ministry of Unification, with executables disguised as Hangul documents through double extensions, convincing icons, and decoy content. Its multistage scripts retrieved changeable command-and-control information from Google Drive, downloaded additional modules, collected host and file information, and supported command execution, file transfer, keylogging, and screen capture. Shared shellcode, scripts, malware code, and infrastructure linked the activity to earlier Kimsuky operations, but the attribution was presented as an assessment.