Lazarus_Group__2020__Kaspersky_Lazarus-covets-COVID-19-related-intelligence_12-23-2020.pdf

**Executive summary:** Kaspersky documents two Lazarus group intrusions targeting COVID-19-related organizations — a Ministry of Health compromised with an in-memory wAgent backdoor and a pharmaceutical company infected with Bookcode via a supply-chain or targeted intrusion — describing infection chains, post-exploitation activity (credential dumping, lateral movement, AD enumeration), C2 infrastructure, and IoCs to support detection and remediation.