Operation Rocket Man was an August 2018 Geumseong121 spear-phishing campaign targeting selected South Korean victims, including defense and North Korea-related communities. Operators impersonated a corporate human-resources contact and linked victims to files hosted on a compromised Korean website, styling the link as an email attachment rather than attaching the lure directly. The resulting chain used encrypted configuration data and a cloud messaging channel for command and control, while planted Chinese-language artifacts were assessed as false-flag material rather than reliable attribution evidence.