The report analyzes an APT-C-26/Lazarus campaign that delivered a weaponized IPMsg installer to targets. When executed, the installer dropped a malicious DLL while also launching the legitimate IPMsg Installer 5.6.18.0 to reduce user suspicion. The DLL chain decrypted and loaded multiple additional DLLs, used validation checks to hinder standalone sandbox execution, communicated with C2 over HTTP using encoded parameters and random strings, validated downloaded payloads by MD5, decrypted them with HC-256, and ultimately established a backdoor capable of fetching and executing further payloads.