Kaspersky links BlueNoroff to the broader Lazarus ecosystem and describes a continued shift from bank and SWIFT fraud toward cryptocurrency theft through the SnatchCrypto campaign. The activity targeted cryptocurrency startups and businesses by abusing trusted communications, including compromised or impersonated company accounts, forwarded emails, LinkedIn outreach, and fake investment or document-sharing lures. Infection chains used weaponized Word documents exploiting CVE-2017-0199, remote templates, VBA macros, process injection into notepad.exe, possible dccw.exe auto-elevation abuse, zipped Windows shortcut lures, VBS and PowerShell stages, and backdoor deployment. The report highlights attacker infrastructure and tracking techniques such as third-party email tracking, Sendgrid sender abuse, remote template retrieval, and C2-based staged payload delivery. The findings matter because BlueNoroff tailored social engineering to real business relationships and cryptocurrency workflows, reducing the need for zero-days while improving the chance of initial access.