Operation Low Kick was a March 2019 Kimsuky watering-hole campaign aimed at people who visited South Korean policy, diplomacy, security, unification, and North Korea research websites. Attackers compromised multiple relevant sites and inserted obfuscated scripts that exploited a browser vulnerability, launched a system process, downloaded shellcode disguised as an image, and injected the decoded module into a legitimate Windows process. The final malware collected system details, logged keystrokes, searched for common document formats, and communicated with command infrastructure; shared exploit code and payloads tied the separate site compromises into one operation.