NetSupport Manager is legitimate remote-administration software that can be deployed without authorization and operated as a remote-access Trojan. Its normal remote-control functions provide attackers with command-and-control access to a compromised host and can support the installation of additional malware. A Lazarus-themed campaign used NetSupport in this manner, continuing a long pattern of abuse by multiple advanced threat groups. Because the same software has lawful enterprise uses, malicious activity depends on unauthorized installation, attacker-controlled infrastructure, and surrounding behavior rather than the product name alone.