SlowMist attributes a June 2024 intrusion set against cryptocurrency exchanges to Lazarus Group after forensic work across multiple incidents. The attackers used social engineering against developers, including fake project-team and investment personas, to get employees to run trojanized Python projects such as StockInvestSimulator-main.zip and MonteCarloStockInvestSimulator-main.zip. The payload abused unsafe PyYAML loading for remote code execution, established access on employee devices and Docker environments, then moved through internal services, stole SSH keys, reached wallet servers, and deleted or tampered with logs and samples. SlowMist published representative infrastructure including gossipsnare.com, showmanroast.com, getstockprice.info, eclairdomain.com, replaydreary.com, several IP addresses, GitHub accounts, and a Telegram handle tied to the activity.