Operation Stealth Power was a March–April 2019 Kimsuky campaign against South Korean foreign-affairs, security, unification, and North Korea-related organizations. Operators sent highly tailored Korean spear-phishing emails with password-protected HWP documents themed around regional security developments, complicating automated inspection and discouraging recipients from sharing the messages. Embedded exploit code launched an HTA stage and PowerShell-based keylogging, communicating through a compromised Korean web server to steal information while minimizing visible artifacts.