Operation Mystery Baby was a late-October 2018 South Korea-focused cyber-espionage campaign attributed to a government-backed group and strongly linked by code and delivery patterns to Operation BabyCoin. Malware disguised with the icon of a Korean security product was built in separate 32-bit and 64-bit versions and could steal system information, keystrokes, account data, and other sensitive material. Related activity combined tailored Korean phishing, webmail credential theft, and malicious HWP documents. Its staged payload chain downloaded encrypted components, decrypted them with RC4-derived logic, and used startup shortcuts to maintain execution.