Operation Coin Manager was a December 2017 targeted intrusion campaign against people connected to South Korea’s cryptocurrency sector. Operators disguised an executable as personal financial-management software and began infection as soon as the purported installer ran, extracting a hidden payload and communicating with multiple command-and-control servers over encrypted channels. The campaign was linked through recurring code patterns to a long-running attack organization associated with major South Korean disruptions and financially motivated intrusions.