Lazarus_Group__2021__Lazarus_Group_Recruitment_Threat_Hunters_vs_Head_Hunters.pdf

Positive Technologies documents a September–November 2020 Lazarus Group spearphishing campaign that lured victims with fake General Dynamics job offers to deliver malicious Office/PDF documents containing VBA macros; these deployed the Agamemnon downloader and CommsCacher backdoor, enabling network reconnaissance, persistence (LNK autoruns, service creation, account creation), lateral movement and partial control of a pharmaceutical company's infrastructure. The report maps observed behaviors to MITRE ATT&CK, provides IOCs (file hashes, domains, IPs, C2 lists), artifacts used for forensic reconstruction, and links the activity to known Lazarus tooling and prior campaigns.