The talk tracks Lazarus activity through the DeathNote cluster, starting with cryptocurrency exchange targeting that used malicious documents and trojanized trading applications. The speaker links the cluster to downloaders named dm.dll and dn64.dll, which collect victim information, contact C2 servers, and fetch follow-on payloads. By early 2020 the same activity shifted toward defense contractors, using job-themed decoys tied to aerospace and defense companies and techniques associated with Operation Dream Job.