Lazarus_Group__2021__ASEC_REPORT_vol.102_ENG_4.pdf

ASEC (AhnLab) analyzes 'Operation Dream Job', a targeted campaign that impersonates recruiters to deliver downloader malware (Lcpdot, Torisma and related samples) — some binaries digitally signed with a '2 TOY GUYS LLC' certificate — against aerospace/defense job seekers across multiple countries; the report provides technical analysis, IoCs (file hashes, filenames, URLs/domains), evidence of C2 reuse linked to other Lazarus-related activity, and defensive detections, while cautioning that firm attribution remains inconclusive.