Lazarus_Group__2020__ADEO-Lazarus-APT38.pdf

**Executive Summary:** This public ADEO DFIR report analyzes a Lazarus/APT38 campaign ("Pot Of Gold", Apr 2020) that exploited SharePoint RCE (CVE-2019-0604) to deploy PowerShell Empire and custom RAT/ELECTRICFISH tooling, perform credential theft and lateral movement, and deploy ATM-targeting DLLs to intercept transactions; the report includes technical malware analysis, MITRE ATT&CK mapping, and IOCs (hashes, IPs, domains).