Operation Mystery Egg was a 2018 spear-phishing campaign attributed to the state-backed Geumseong121 group and aimed primarily at South Korean targets. Attackers impersonated an official survey concerning separated Korean families and attached an HTML file styled as a protected email attachment rather than sending the malicious executable or HWP document directly. The chain used obfuscated document exploit code and encrypted payloads that communicated through Dropbox-based command-and-control, while conspicuous Russian-language artifacts were assessed as a likely false flag.