Cyble analyzed Quantum Software, also called Quantum Builder, a criminal LNK, HTA, and ISO builder advertised with extension spoofing, icon customization, payload URLs, DLL support, UAC-bypass options, and claimed DogWalk exploitation. The observed LNK sample executed obfuscated PowerShell that launched mshta against quantum-software[.]online to retrieve an HTA payload, illustrating abuse of LOLBins for phishing delivery and defense evasion. Cyble noted a possible Lazarus connection because recent Lazarus LNK delivery samples used a similar deobfuscation loop and variable initialization, but the report presents this as a tentative association rather than confirmed attribution.