Kaspersky reported a Lazarus operation active since at least November 2018 targeting cryptocurrency businesses, especially South Korean exchanges. Attackers used weaponized Korean and Chinese business documents, PowerShell backdoors for Windows, malicious HWP delivery, and expanding macOS malware for Apple users. The malware communicated with C2 scripts disguised as WordPress or open-source project files, while infrastructure separated rented malware hosts from compromised C2 servers. Payloads included 32-bit and 64-bit Windows variants with CheckSelf and battle naming, reinforcing Lazarus's continued financial targeting.