Positive Technologies describes a Lazarus Group intrusion into a large pharmaceutical company that began with job-offer lure documents delivered to employees, including one case over Telegram. Opening the documents enabled malicious macros on home computers, after which the attackers ran reconnaissance utilities and deployed CommsCacher components with persistence artifacts and encrypted configuration. The compromised hosts connected to forecareer[.]com, a recently registered domain mimicking General Dynamics Mission Systems, and later gave the attackers access through the company RDG environment. Within four days the operators reached servers including a domain controller, file server and additional RDG server, using system utilities, ADFind-like tooling and custom services to expand control.