Operation WaterTank was a covert watering-hole campaign conducted in April and May 2018 against South Korean think tanks, North Korea-focused organizations, and military-related websites involved in diplomacy, security, and unification issues. Attackers compromised specialized sites frequented by the intended community and inserted exploit code for software commonly used by Korean institutions, seeking access to internal systems and sensitive information. The activity was assessed as state-sponsored because its telemetry and techniques closely matched years of reconnaissance and intrusion activity against South Korean defense, finance, security, government, and large-enterprise targets, but the responsible state or group was not named definitively.