Kaspersky reported two Lazarus-linked intrusions against COVID-19-related targets: a government health ministry compromised in October 2020 and a pharmaceutical company breached in September 2020. The ministry case used the wAgent malware cluster, including rundll32 execution of javac.dat with an AES key, in-memory payload loading, randomized C2 URL paths and POST parameter names, and follow-on shell commands for host and domain reconnaissance. The pharmaceutical case involved Bookcode malware previously associated with a South Korean software supply-chain attack. The report ties the incidents to Lazarus through malware and post-exploitation overlaps and shows the group collecting intelligence from pandemic-response and vaccine-related environments.