The North Korean-backed threat organization Lazarus continues to target entities in a sophisticated social engineering campaign, this time targeting organizations and employees in the chemical sector. This cyber-espionage driven campaign has been code named “Operation Dream Job,” and carries the reputation of distributing malicious phishing emails to organizations throughout the defense, government, and engineering sectors. These phishing emails are themed around fake job offers as the key means to lure in users to download malware-laced attachments or visit malicious hyperlinks. Once a user interacts with these elements of the phishing email, an HTM file is downloaded to the system and implanted within the DLL file “scskapplink.dll”. Acting as a trojanized tool, the DLL file then proceeds to download additional payloads from actor-controlled command-and-control (C2) server(s) and executes those payloads onto the user’s device. Once completed, Lazarus threat actors have the capability to move laterally within the compromised user’s network, exfiltrate sensitive information such as security credentials, download and install additional espionage scripts, and implant persistence mechanisms on the system. CTIX analysts continue to urge users to validate the integrity of email correspondence prior to downloading any attachments or visiting any links embedded in the email to lessen the possibility of threat actor compromise.