NSHC ThreatRecon reports a long-running campaign targeting finance and investment-sector organizations in multiple countries with malicious Word documents disguised as investment, NDA, and company-related files. The documents used remote template injection rather than embedded macros, causing Office to contact attacker-controlled HTTPS C2 domains such as lundbergs[.]cc and download a malicious template or payload only after the target opened the lure. The infrastructure used many domains on HOSTWINDS-hosted address space and rotating multi-domain TLS certificates, with detections referencing Lazarus APT maldoc certificates. The source finds some links to a state-sponsored hacking group but cautions that the available evidence is insufficient to definitively attribute the activity to a government-backed financial theft operation.