QiAnXin RedDrip reported a suspected Lazarus spearphishing campaign against Korean enterprises using malicious DOCX and CHM lures rather than consumer-targeted activity. The DOCX samples abused CVE-2017-0199 remote template execution, including lures such as disaster-aid applications and Korean corporate documents, then downloaded 32-bit or 64-bit macro payloads from naveicoipg.online-style infrastructure and injected code into winword.exe. The malware performed sandbox and Korean antivirus checks, dropped RuntimeBroker.exe under the Microsoft TokenBroker path, used a local RPC UAC-bypass technique, added Windows Defender exclusions, and used Dropbox-hosted data as an intermediary for C2 configuration. The report links the activity to Lazarus based on Dropbox use, RuntimeBroker behavior, overlap with prior public reporting, and related IOCs such as naveicoipc.tech and multiple naveicoip* domains.