Sygnia links a double-extortion ransomware intrusion to a new, undocumented variant of the Lazarus-associated MATA malware framework that was used to deploy TFlower ransomware. The report says the relationship between Lazarus and TFlower requires further validation, but the shared MATA loader/backdoor components and infrastructure suggest a connection or collaboration that may support DPRK cyber-extortion revenue activity. MATA used EXE, DLL and DAT components in System32, injected into svchost.exe, persisted through the LSA Security Packages registry value, and provided remote code execution, screen capture and network tunneling. Sygnia also identified more than 150 MATA C2 IPs and over 200 related certificates since May 2019.