Kaspersky reports that Lazarus used the ThreatNeedle malware cluster, an advanced Manuscrypt/NukeSped variant, in attacks against defense-industry organizations in more than a dozen countries. The campaign began with carefully tailored COVID-19-themed spear-phishing emails sent from lookalike accounts, including malicious Word documents or links and follow-up instructions to enable macros when the first attempt failed. After initial access, the attackers gathered credentials, moved laterally, and bypassed network segmentation by compromising an internal router machine as a proxy to exfiltrate intranet data to remote servers. The investigation also tied the infrastructure and scripts to other Lazarus campaigns and noted use of multiple C2 servers across attack stages.