The Blockbuster Sequel

Unit 42 documents a targeted malware campaign (The Blockbuster Sequel) that delivers VBA-macro-laced Korean-language Word documents via likely spear-phishing, which drop packed backdoor payloads tied by code and infrastructure to the Lazarus group (Operation Blockbuster); the report includes behavioral analysis, unpacked assembly excerpts, cleanup batch scripts, fake TLS/SNI usage, and extensive IOCs (file hashes, C2 domains, IPs) to aid detection and response.