JPCERT/CC reports Lazarus activity against organizations in Japan where different malware was used during initial network intrusion and after compromise. The post-intrusion malware downloaded and executed modules, used service-based persistence from Windows system paths, was obfuscated with VMProtect, communicated with command-and-control infrastructure using AES key exchange, and loaded UPX-packed modules to receive attacker commands.