Lazarus Group Recruitment: Threat Hunters vs Head Hunters

This report presents an analysis of an intrusion attributed to the Lazarus Group against a pharmaceutical company in late 2020: attackers delivered malicious documents which deployed malware that enabled reconnaissance, lateral movement and partial control of the infrastructure within four days; the report describes the group's TTPs, examples of malicious documents, network traffic captures, logs and artifacts to help incident responders identify compromised hosts and indicators of compromise.