Spy Cloud is a March 2020 Geumseong121 spear-phishing operation targeting South Korean diplomats, unification and security professionals, leaders of North Korea-related organizations, and defectors. Emails used purported evidence of a disguised defection to entice recipients to follow a link and open a malicious Word document containing an obfuscated VBA macro and shellcode. The chain retrieved an executable from Google Drive and exfiltrated host information through pCloud, using trusted cloud services to avoid attachment filtering, change or remove hosted payloads, and reduce traceable infrastructure.