JPCERT/CC’s English Operation Dream Job report analyzes Torisma and LCPDot malware used by Lazarus/Hidden Cobra. Torisma is a rundll32-executed downloader that loads C2 configuration from a signed local file, uses the VEST-32 algorithm and a repeated encryption key, and downloads encrypted modules after a two-stage HTTP POST exchange. LCPDot is described as a similar downloader, sometimes VMProtect-obfuscated, likely used for lateral movement after Torisma infection; it supports RC4-key and Base64-encoded C2 options and stores encoded configuration data. The report provides protocol details, configuration locations, module behavior, and C2 infrastructure useful for defensive hunting.