Lazarus Group Deploys Weaponized Documents Against Aerospace & Defense

Security researchers at ENKI have uncovered a sophisticated espionage campaign in which the Lazarus Group weaponises a new Comebacker backdoor variant to target aerospace and defence organisations, distributing malicious Word documents that prompt macro execution. The threat actor has been actively conducting phishing since at least March 2025, with the campaign beginning to be observed more clearly in June 2025 after reports of a malicious domain, office-theme[.]com, attributed to the Lazarus Group.

Analysis shows a multi‑stage infection chain delivering the Comebacker variant to victim systems, with infrastructure including a second C&C domain and related samples, suggesting months of ongoing activity. The weaponised documents use lures impersonating Edge Group, IIT Kanpur and Airbus, reflecting targeted spear phishing aimed at a narrow set of high‑value organisations.

The new variant encrypts C&C traffic with AES‑128‑CBC and uses ChaCha20 for some operations, and the loader writes components to system directories such as C:\ProgramData\WPSOffice\wpsoffice_aam.ocx, with persistence via startup shortcuts; it also notes MD5 hash verification for downloaded payloads.