Kaspersky's Q1 2022 APT trends report describes a Lazarus-linked campaign using a trojanized DeFi Wallet application compiled in November 2021. The application installed a fully featured backdoor while posing as legitimate cryptocurrency wallet software, and Kaspersky found overlaps with other Lazarus tools. The operators used compromised South Korean web servers in a staged C2 setup, with one stage serving the backdoor and another communicating with implants; server logs showed infections at a global level.