Lazarus_Group__2013__dissecting-operation-troy.pdf

McAfee Labs' analysis of "Operation Troy" (Dark Seoul) describes a sustained APT campaign from 2009–2013 that conducted covert espionage against South Korean military and government networks, maintained encrypted IRC/HTTP command-and-control infrastructure, exfiltrated sensitive documents, and culminated in a destructive MBR-wiping event on March 20, 2013; the report details the malware components, toolchain (bs.dll/payload.dll), compile paths and IOCs, and attributes activity to a group using Roman-themed markers (NewRomanic Cyber Army Team).