Researchers from Google’s Threat Analysis Group (TAG) have published a report attributing a notorious North Korean state-sponsored threat actor known as “Lazarus”, to campaigns facilitated by exploiting a specific zero-day Google Chrome vulnerability. The flaw, tracked as CVE-2022-0609, is a use after free vulnerability that if exploited, could allow attackers to perform remote code execution (RCE). The campaign targeted individuals from the media, IT, cryptocurrency, and fintech sectors. The victims were targeted with fraudulent job-hunting scams utilizing fake emails, fake websites, and real websites that had already been compromised by Lazarus to execute the exploit kit. After interacting with one of the attack vectors, the victims would unknowingly execute the malware. Google TAG first identified the critical vulnerability in early February and proceeded to release an emergency security patch that fixed the flaw, but upon further research, they found signs that the campaign had actually been in full effect since the beginning of January. As already stated, this vulnerability has been successfully patched, so users running updated versions of Chrome are not susceptible to this attack. The Ankura CTIX recommends all users run the most stable versions of their browsers, and more significant exploit campaigns like this will continue to be reported on in the future.