This blog details the markers of this campaign, including macro content, campaign flow and phishing themes of our identified variants and older variants that have been attributed to Lazarus by other vendors. The Qualys Research Team recently identified a new Lazarus campaign using employment phishing lures targeting the defence sector. This is thematically similar to other observed variants where Lazarus has posed as defence companies like Northrop Grumman and BAE Systems with job openings. LockHeed Recruitment Lure . The macro uses aliases to rename the APIs that it uses (fig. 5). Other variants have used the UuidFromStringA function to decode the embedded payload and write it to an executable Heap. Lazarus has also used other novel methods to execute shellcode such as by using the function EnumSystemLocalesA as a callback to shellcode written to executable heap. 8). shellObj is the Wscript.Shell object that the vbs file uses to execute the beacon command. Additional vendors have also identified a variant that uses pcalua.exe. Additional vendors have reported on the current campaign while attributing it to Lazarus. Lazarus continues to evolve its capabilities by utilizing lesser-known shellcode execution techniques and incorporating various lolbins as part of its campaign