SectorA05 used Operation Kitty Phishing to target 77 reporters covering South Korea’s Unification Ministry with malware-laden email in January 2019, while also running credential-phishing campaigns against South Korean central government, unification, diplomacy, defense, cryptocurrency exchange, and individual targets. The infection chain used password-protected archives, disguised HWP-themed executables, WSF scripts, and two RAT paths: a DLL-based downloader for Freedom.dll and a script-based RAT registered for persistence under an AhnLab-themed registry value. The malware relied on Google Drive to host payloads or C2 configuration and used infrastructure including my-homework.890m[.]com and ago2[.]co[.]kr, with infection progress logging, command retrieval, upload/download functions, and selective Cobra_[MAC Address] payload delivery. The report links these techniques to information theft and cryptocurrency-focused objectives, making the campaign relevant for defenders tracking South Korea-focused DPRK tradecraft and long-lived C2 reuse.