ENKI identified a Lazarus-attributed Comebacker variant delivered through malicious Word documents staged on office-theme[.]com and themed around aerospace and defense organizations. When macros run, the dropper decrypts a loader and decoy document, writes wpsoffice_aam.ocx and USOPrivate.dll, creates Startup-folder persistence, and executes the final Comebacker payload in memory. Comebacker beacons over HTTPS to hiremployee[.]com with AES-encrypted and Base64-encoded traffic, then can download encrypted follow-on payloads after MD5 validation and ChaCha20 decryption. Infrastructure pivoting found birancearea[.]com and a related March 2025 Comebacker sample, indicating the campaign may have been active before the observed June 2025 documents.