Strangereal Intel reviewed October 2019 Lazarus activity involving multiple document-based intrusions. One HWP lure targeted South Korean CES 2020 exhibitors through CVE-2017-8291/EPS execution, collected host, disk, process, and file information, and contacted C2 hosted on apparently compromised cloud or WordPress infrastructure. The report also describes a HAL-themed maldoc against India’s aeronautics sector that used VBA macros, Macro_pack-style code, and a backdoor able to enumerate systems, capture keystrokes and screenshots, exfiltrate files, and receive commands. A later cross-platform maldoc used Mac and Windows payload logic and a C2 loop supporting download, execute, command-shell, sleep, and session-control functions, showing Lazarus interest in aerospace and high-technology targets.