JPCERT/CC describes Lazarus activity against Japanese organizations using the VSingle and ValeforBeta HTTP bot families. VSingle runs through Explorer DLL injection in some samples, decodes obfuscated strings with a fixed XOR key, communicates with C2 over HTTP GET requests that include Base64-encoded host data, and can execute commands or download PE, VBS, BAT and shellcode plugins. ValeforBeta is a Delphi HTTP bot that uploads, downloads and executes commands through POST traffic disguised with cookie-based host information and BMP-like command results. The report provides C2 examples such as maturicafe.com and 3.90.97.16 and details proxy support, configuration fields and command sets for detection.