AhnLab analyzes Lazarus-linked Volgmer backdoor activity and the later Scout downloader, showing how the group evolved tooling used for post-compromise control of infected systems. Volgmer was used from at least 2014 through around 2021, commonly installed as a service under legitimate-looking names, with encrypted configuration data stored in the Windows registry and C&C addresses read at runtime. The report links Lazarus targeting to Korean defense, satellite, software, media, manufacturing, ICT, and financial organizations, including exploitation of Korean financial security certification software and lateral movement through vulnerable security or asset-management software. Scout appears from around 2022 as a downloader with a similar operating model, used to retrieve a presumed backdoor payload and observed alongside techniques such as BYOVD to disable security products.