State-sponsored attackers compromised legitimate South Korean websites and inserted exploit code targeting vulnerabilities in locally deployed security software, enabling drive-by malware installation. The recovered chains used ChaCha20 or AES-CBC-128 encryption, custom in-memory PE loading, service-slot hijacking, SSP persistence, registry and NTFS ADS storage, and modules concealed in valid PNG files. One final backdoor was identified as a COPPERHEDGE variant and supported system profiling, remote commands, file theft, payload execution, and process injection through encrypted HTTP or HTTPS traffic. Missing activation arguments, shellcode, ADS data, and externally stored keys prevented complete reconstruction of every infection chain.