South Korea's Defense Acquisition Program Administration found abnormal traffic from agency IP space after National Intelligence Service monitoring in late 2018. Investigators reviewed 30 internet-connected PCs, confirmed infections on 10 systems, and examined whether recovered encrypted files from additional machines affected national security. The incident underscores exposure in defense procurement networks and the importance of agency coordination when endpoint compromise is detected.