Unit 42 described November 2018 spear-phishing against a U.S. university conference and a U.S. national security think tank using messages impersonating a nuclear security expert. The attached malicious Office documents launched BabyShark by running a remote HTA with mshta from tdalpacafarm[.]com. BabyShark is VBScript-based malware that changes Office macro-warning registry settings, collects host information, sends it to C2, establishes persistence, and waits for operator instructions. Unit 42 assessed that the activity shared infrastructure with North Korea-linked campaigns and overlapped with the STOLEN PENCIL cluster.