NCC Group details Lazarus initial-access activity built around LinkedIn impersonation, WhatsApp contact, and job-themed ZIP files containing malicious Office documents. The lure infrastructure included global-job[.]org, a domain likely chosen to imitate a legitimate recruitment site, and the macro execution path called rundll32.exe against C:\ProgramData\packages.mdb before suspected LCPDot deployment. Investigators recovered a large, timestomped downloader placed at C:\ProgramData\Oracle\Java\JavaPackage.dll and persisted through a daily scheduled task named “Windows Java Vpn Interface.” The LCPDot variant registers infected hosts with C2 using encoded session data, requests a second-stage payload, decrypts it with RC4-derived key material, and executes it in memory; listed infrastructure includes compromised domains and 13[.]88[.]245[.]250.