360 researchers attributed a campaign with high confidence to APT-C-26, also described as Lazarus, in which attackers weaponized the open source SumatraPDF Reader. The attackers built trust with targets over Telegram, sent a modified PDF reader and a crafted PDF, and triggered encrypted payloads when the victim opened the document. The chain uses multiple loader stages, writes usrgroup.dat and thumbcache_512.db under AppData, and persists or executes through scheduled tasks or registry changes before a downloader contacts attacker-controlled C2. The report cites infrastructure such as blockchain-newtech.com and 103.179.142.171 and notes that the technique matches earlier Lazarus use of weaponized open source projects.