Kaspersky tracks Lazarus Group's DeathNote cluster, also associated with Operation DreamJob or NukeSped, from cryptocurrency-focused attacks into defense-related, automotive, academic, IT, and South Korean targets. Early activity used malicious cryptocurrency-themed Word documents that loaded downloader malware and follow-on backdoors, including Manuscrypt, while later operations used defense job lures, remote template injection, and Trojanized open-source PDF viewer software. The DeathNote downloader collected victim information and retrieved next-stage payloads such as COPPERHEDGE or BLINDINGCAN at the operator's direction. The report highlights Lazarus tradecraft evolution across lures, persistence, Trojanized applications, and in-memory payload execution.