20231013_Lazarus_OP.Dream_Magic.pdf

## Executive Summary AhnLab presents "Operation Dream Magic", a seven‑month analysis of watering‑hole attacks that abused the MagicLine client to distribute Lazarus-linked malware. The report details 105 confirmed detections across ~40 organizations (IT, defense, media, finance, etc.), multiple case studies showing DLL side‑loading and fileless payloads, C2 domains/IPs, malware hashes, and behavioral indicators; it concludes attribution to Lazarus based on shared reassembly code and SYS-file generation patterns and provides concrete mitigation steps (remove/update MagicLine, enable behavior-based detection, extend log retention).