Kaspersky attributed a 2021 South Korea-focused campaign to Andariel, a Lazarus sub-group, based on code overlap with earlier Andariel malware and distinctive post-exploitation command usage. The activity used weaponized Korean Word documents and PDF-like delivery paths that launched HTA payloads with mshta.exe, including URLs on compromised sites such as allamwith.com, jinjinpig.co.kr, ypelec.co.kr, and conkorea.com. The second-stage “Simple agent” decrypted and ran an embedded payload in memory before selected victims received a final backdoor, and one victim was also infected with custom ransomware. The ransomware component and prior ATM compromise show Andariel combining espionage tradecraft with financially motivated operations.