NCC Group
RIFT: Analysing a Lazarus Shellcode Execution Method (macro documents disguised as job descriptions via LinkedIn) · (no date on page)
On January 21st, the following malware sample was shared by CheckPoint research team via Twitter . The post mentions that this loader belongs to Lazarus group. The modus operandi of phishing with macro documents disguised as job descriptions (via LinkedIn), was also recently documented by ESET in their Operation In(ter)ception paper .