Since late 2021, threat actors from the Lazarus Group have been using sophisticated backstop personas to target defense contractors in Europe and the Middle East. The primary aim of their campaign appears to be cyber espionage, though they had made unsuccessful attempts to benefit financially as well. Actors utilized social platforms such as LinkedIn and WhatsApp, posing their backstop personas as job recruiters and delivering malware-laced job description documents to end users. When the original campaign occurred in 2020, users within Brazil, Czech Republic, Ukraine, Turkey, and Qatar were the victims of this campaign, however in the most recent campaign users from France, Italy, Spain, Netherlands, and Poland are now being targeted. Threat actors often rode on the backs of legitimate recruitment services to mask their approach and build trust between them and the end user. While the specific types of malicious programs were not disclosed, it is likely the malware exfiltrated information on the end user from system information to personal identifiable information. CTIX analysts urge users to never open attachments or hyperlinks sent from random users in order to lessen the risk of threat actor compromise.