STARKMULE is an ongoing spearphishing campaign identified in July 2023 that targeted Korean-speaking victims with documents themed around United States military recruitment. Its operators staged malware and command infrastructure on compromised South Korean e-commerce websites, allowing malicious traffic to blend with legitimate activity and improving resilience against detection. The victimology and tradecraft resembled prior North Korean operations such as APT37, but the actor’s North Korean origin had not been confirmed, so the campaign should be treated as suspected rather than firmly attributed.