ESET links a Lazarus Operation DreamJob campaign against Linux users to broader evidence connecting the group with the 3CX supply-chain compromise. The Linux intrusion chain used a ZIP archive containing a fake HSBC job offer lure, where a deceptive Unicode filename made a native Go ELF appear like a PDF while executing OdicLoader. OdicLoader opened a decoy PDF, downloaded the SimplexTea Linux backdoor from OpenDrive, stored it under ~/.config/guiconfigd, and modified ~/.bash_profile for persistence. The finding matters because it shows Lazarus extending DreamJob tooling to Linux while targeting all major desktop platforms and provides additional technical support for the suspected Lazarus role in the 3CX incident.