ENKI analyzes a Lazarus Group Comebacker variant recovered from office-theme[.]com, where malicious DOCX files with VBA macros acted as droppers for a staged loader chain. The lures impersonated aerospace and defense-related organizations including Edge Group, IIT Kanpur, and Airbus, suggesting spear-phishing against sector-specific targets. The DOCX macros decrypted and dropped a loader and lure document, installed persistence through LNK and startup-folder mechanisms, and executed USOPrivate.dll through rundll32. The final Comebacker payload contacted hxxps://hiremployee[.]com over HTTPS with AES-128-CBC-protected traffic, while related infrastructure such as birancearea[.]com and a March 2025 sample showed changes in loader encryption and C2 communications.