Unit 42 links newly observed malicious Word documents and payloads targeting Korean-speaking individuals to Lazarus activity previously described in Operation Blockbuster. The documents likely arrived through spear phishing, used Korean decoy content, and relied on VBA macros that reconstructed and XOR-decoded an embedded PE file before writing and executing it on disk. The implant maintained persistence from the temporary directory and communicated with hard-coded IPv4 C2 servers using a fake TLS protocol with misleading SNI values such as major web and collaboration services. Additional related samples shared macro logic, cleanup batch-script behavior, command execution routines, and indirect library-calling techniques with known Lazarus samples, giving defenders concrete code and infrastructure overlaps to hunt.