Trend Micro reassessed OnionDog activity that had been publicly linked to alleged attacks on South Korean energy and transportation organizations and concluded the samples were part of cyber drills rather than a targeted intrusion campaign. Historical passive DNS and HTTP-response evidence tied most cited C2 IP addresses back to South Korea's National Cyber Security Center, while older samples displayed Ulchi drill infection messages during exercise windows. Later OnionDog samples used .onion.city C2 domains, dropped multiple resources, bypassed UAC, installed Windows services, sent basic host information, and could download second-stage payloads. The report matters because about 200 OnionDog samples were found in the wild, showing how live or simulated malware used in exercises can leak tradecraft and create attribution and response confusion.