Mandiant identified UNC4034 using a fake Amazon job opportunity to move a media-industry victim from email to WhatsApp and deliver a malicious ISO named amazon_assessment.iso. The ISO contained a trojanized PuTTY executable and a Readme with connection details; attempting the SSH workflow triggered embedded malicious code that dropped colorui.dll and used DLL search order hijacking through colorcpl.exe. Persistence was created with a scheduled task named PackageColor, and the DLL decrypted DAVESHELL shellcode that loaded AIRDRY.V2, a VMProtect-packed evolution of the AIRDRY/BLINDINGCAN backdoor. Mandiant noted overlaps suggesting a North Korea nexus, and the case is significant because it combines recruiter-themed social engineering, ISO delivery, trojanized legitimate tooling, and a plugin-oriented backdoor chain.