A Lazarus group cyberespionage campaign targeted a Spanish aerospace company by impersonating Meta recruiters on LinkedIn and sending trojanized coding challenges. The attack used spearphishing via LinkedIn Messaging to deliver malicious executables disguised as C++ programming tests. The campaign deployed multiple malware tools including LightlessCan, a new backdoor with enhanced stealth and command capabilities, NickelLoader downloader, and miniBlindingCan variant. DLL side-loading was used to load payloads, and the attack aimed to steal aerospace technology and know-how, aligning with North Korean strategic interests.