A Lazarus Group campaign, active from early 2020 until January 2023, leveraged a backdoored UltraVNC client against manufacturing and real-estate sectors in India and telecommunications companies in Pakistan and Bulgaria. The goal of the operation, whose scope extends beyond Bulgaria, India, and Pakistan, appears to be intelligence collection.