Using Frame1_Layout for macro execution and using lesser known API calls for shellcode execution is known to be used by Lazarus. We also were able to find infrastructure overlap between this campaign and past campaigns of Lazarus (Figure 19