ESET described Operation In(ter)ception, targeted attacks against aerospace and military companies in Europe and the Middle East observed from September to December 2019. The attackers used fake LinkedIn recruiter personas and bogus job offers to deliver password-protected RAR archives containing LNK files, then used remote XSL scripts, renamed Windows utilities, scheduled tasks, custom DLL loaders, a staged downloader, and a modular C++ backdoor. The primary objective was espionage, although one investigated case ended with an attempted business email compromise using a victim’s mailbox. ESET did not make a firm attribution, but noted hints suggesting a possible Lazarus link based on targeting, development environment, and anti-analysis similarities.