Lazarus_Group__2022__Symantec_Lazarus-Targets-Chemical-Sector_04-14-2022.pdf

Symantec reports that the Lazarus APT (tracked as Pompilus / Operation Dream Job) conducted a targeted espionage campaign against organizations—primarily in South Korea's chemical sector—using fake job lures that deploy malicious HTM files which are copied into signed Trojanized DLL/CPL components (e.g., scskaplink.dll, final.cpl) to load shellcode, download backdoors, dump credentials, move laterally via WMI/MagicLine, establish persistence (scheduled tasks/services), and deploy post-compromise tools; the report includes detailed TTPs and IOCs (SHA-256 hashes, IPs, domains, URLs, filenames, and service names) and recommends vigilance and updated protections.