Operation Troy was a covert cyber-espionage campaign against South Korea from 2009 to 2013 that culminated in the destructive March 20, 2013 attacks on banks and news organizations. Attackers had likely established access through spear-phishing and remote-access malware before deploying a master-boot-record wiper that disabled tens of thousands of computers. The operation combined long-term military and government intelligence collection with a final disruptive action, making it more than opportunistic cybervandalism. Attribution was assessed as suggestive rather than definitive, and analysis allowed for the possibility that two distinct groups participated.