AT&T Alien Labs reports Lazarus-attributed malicious document activity in spring 2021 that targeted engineering job candidates or employees in classified engineering and defense-related roles in the United States and Europe. The lures impersonated Rheinmetall, General Motors, and Airbus opportunities, continuing the group's pattern of job-themed targeting against defense contractors and engineering organizations. The macro malware decoded embedded payloads with certutil, masqueraded activity under C:\Drivers, abused renamed Windows utilities such as Certutil, Explorer, and Mavinject, injected into explorer.exe, and contacted hardcoded HTTPS C2 infrastructure assessed as compromised third-party domains. The source highlights iterative changes across the documents to reduce detection while preserving the same core remote-template, macro, compromised-infrastructure, and proxy C2 tradecraft.