rp-operation-sharpshooter.pdf (7 MB)

McAfee documented Operation Sharpshooter, a global campaign against nuclear, defense, energy, financial, defense, and government related organizations. Malicious job description documents with Korean-language metadata used macros and embedded shellcode to inject a downloader into Word, then pulled the Rising Sun second-stage implant from kingkoil.com.sg. The report notes code reuse from the Lazarus Group Duuzer backdoor but cautions that the technical links may be too obvious for firm attribution and could indicate false flags.