Operation Light Shell was a Kimsuky malware and command-and-control activity cluster documented in 2021. Related malicious code was grouped through shared patterns and infrastructure, including a distinctive light-shell signature file consistently found on its command servers. The cluster linked Kimsuky malware with the servers used to manage it and reflected the group’s use of custom tooling for information theft and financially motivated activity against selected targets.