Virus Bulletin analyzes Lazarus-linked activity after Sony Pictures, connecting the 2014 destructive intrusion to earlier Korean bank and media attacks through shared malware code and tool features. The paper describes continued targeted attacks on Korean companies and institutions, including a Seoul ADEX 2015 zero-day, compromises of ICT and web-hosting providers, suspected cryptocurrency-exchange activity, and 2017 cryptocurrency and casino incidents. It distinguishes Bluenoroff as focused on financial institutions and cryptocurrency exchanges and Andariel as South Korea-focused, including military and defense data theft and later financial-sector operations. The excerpt also notes Escad backdoors with clear C2 IP storage, XOR 0xA7 string encryption, unusual dotted cmd.exe API strings, and fake SSL code as recurring technical artifacts.