Lazarus Group Targets More Cryptocurrency Exchanges and FinTech Companies

Intezer's analysis documents a Lazarus Group campaign that lures cryptocurrency and FinTech targets with a fake "Investment Proposal.doc" containing an obfuscated VBA macro which drops a bespoke RAT; the report provides static and dynamic analysis (decryption routines, API resolving, persistence via Startup shortcut), lists command IDs and capabilities, embeds TLS/certificate artifacts and an RSA private key, and publishes IoCs (sample hashes and multiple C2 IP addresses), concluding the group remains active and focused on crypto theft.