A new campaign by the notorious Lazarus Group is targeting energy organizations on a global scale, including the United States, Japan, and Canada. The Lazarus Group is a North Korean-backed threat organization that has been active for well over a decade and specializes in cyber espionage, data theft, and destructive attacks for financial gain. Lazarus has targeted major corporations throughout its time such as Sony Pictures in November 2014, followed by other operations tracked as Operation Troy, Operation Flame, and Ten Days of Rain. In this new Lazarus campaign, threat actors are exploiting Log4J vulnerabilities within VMWare Horizon and deploying VSingle/Yamabot/MagicRAT malware variants for reconnaissance, lateral movement through the network, data exfiltration, credential harvesting, and the disabling of anti-virus applications. Several indicators of compromise seen throughout this campaign point back to known Lazarus servers where the threat actor’s payloads are stored alongside observed tactics and techniques seen in previous Lazarus campaigns. While the victims of the campaign have not been officially disclosed, CTIX urges organizations within the energy sector to monitor for any suspicious activity or detection of the indicators of compromise in the article below. CTIX analysts continue to monitor threat actor activity worldwide and will provide additional context accordingly.