DRATzarus, also tracked as ThreatNeedle, is described as a Lazarus Group remote access trojan used since at least mid-2020 against defense and aerospace organizations. The excerpt says delivery commonly relies on targeted spear-phishing with COVID-19 or fake job lures that lead victims to open malicious documents and install the backdoor. Once active, DRATzarus can provide in-memory remote control, file manipulation, arbitrary command execution, credential harvesting, payload deployment, and lateral movement, including use of a compromised internal server as a proxy to reach segmented networks. The body lists C2 domains, registry artifacts, hashes, and geographically distributed infrastructure across Europe, Asia, and South Korea, underscoring its value for defenders tracking Lazarus espionage against strategic industries.