Contacts an IP address / domain that was used to host a malicious document from a Lazarus previous campaign in 2017 - Same author appeared in these recent malicious documents that also appeared back in Lazarus 2017 campaigns - Uses the same malicious document structure and similar job recruitment ads as what we observed in past Lazarus campaigns - The techniques, tactics and procedures align with Lazarus group’s interest in crypto currency theft