AttackIQ released attack graphs that emulate Lazarus Group tradecraft across historical campaigns including Operation Sharpshooter, Operation In(ter)ception, and Operation Dream Job. The excerpt attributes Lazarus Group to North Korea’s Reconnaissance General Bureau and notes links or overlaps with Andariel, BlueNoroff, APT37, and Kimsuky. The emulations cover delivery of malicious Office documents, LNK files, trojanized DLLs, Startup-folder and scheduled-task persistence, RunDLL32 and Regsvr32 execution, WMI activity, process injection, discovery commands, credential access, staging, encrypted HTTPS exfiltration, and C2 communications. Targeting described in the excerpt includes finance, energy, defense, military, aerospace, government, and other organizations reached through social engineering and fake job offers.