Lazarus_Group__2021__Are_you_afreight_of_the_dark_Watch_out_for_Vyveva_new_Lazarus_backdoor_WeLiveSecurity.pdf

ESET researchers disclose and analyze Vyveva, a Lazarus-linked backdoor used since at least 2018 to target a freight logistics company in South Africa; the report describes installer/loader/backdoor components, Tor-based C2, file-exfiltration, timestomping and watchdog features, lists IoCs (sample hashes, filenames), and maps observed behavior to MITRE ATT&CK techniques.