Lazarus abused the WIZVERA VeraPort software distribution workflow used by South Korean government and banking sites, compromising supported websites and replacing legitimate bundled installers with malware. The attack relied on VeraPort accepting any valid code-signing certificate rather than verifying signer identity, with observed Delfino.exe and MagicLineNPIZ.exe samples masquerading as South Korean security software and signed with certificates issued to ALEXIS SECURITY GROUP and DREAM SECURITY USA.