Anomalous traffic indicative of backdoor installation by Lazarus Group was detected. External communication with a known malicious IP and suspicious file transfer suggest an attempt to establish persistent access to compromised systems.