Zscaler ThreatLabz linked a South Korea-focused phishing and malware campaign to Lazarus with high confidence after correlating reused infrastructure, attacker-controlled Dropbox accounts, registrant email addresses, sender infrastructure, and domains tied to earlier Naver-themed activity. The actor evolved from 2021 Naver credential phishing into 2022 lures spoofing Korean entities such as KRNIC, AhnLab, Binance, and other cryptocurrency or security brands. The attack chains used spear-phishing emails with macro documents or password-protected XLS files, Dropbox-hosted staging, and attacker C2 domains fetched by later-stage binaries. The attribution relied on overlaps including IPs such as 23.81.246.131, historical domain resolutions, and infrastructure also associated with Lazarus activity reported by other researchers.