ShowState was a persistent 2020 campaign that PwC attributed to Black Artemis, its name for HIDDEN COBRA or Lazarus Group, targeting aerospace and defense personnel as well as cryptocurrency organizations. Operators used recruitment-themed social engineering, including fabricated LinkedIn recruiter profiles and extended conversations that sometimes moved to email, WhatsApp, or phone calls. Victims received job-description documents impersonating prominent companies in several countries. Malicious macros dropped and executed a next-stage DLL and the ShowState backdoor. PwC identified the backdoor as BLINDINGCAN and noted related variants, including a Mach-O version, with samples extending back to 2017.