‘Operation Oceansalt’ Attacks South Korea, U.S., and Canada With Source Code From Chinese Hacker Group

McAfee Advanced Threat Research describes 'Operation Oceansalt', a targeted campaign delivering a reconnaissance implant via Korean-language malicious Office documents; Oceansalt reuses code and strings from the 2010 Seasalt/Comment Crew implant, supports drive/file/process reconnaissance, reverse shells, and remote command execution, and was distributed through compromised South Korean websites with control servers observed across multiple countries. The report presents infection waves focusing on South Korean public infrastructure and higher education, expansion to North American targets (financial, healthcare, telecom, agriculture), detailed technical analysis, multiple hashes and IP IOCs, and hypotheses about source-code sharing or false-flag activity.