Operation Dream Job

Operation Dream Job is a North Korean-linked intrusion campaign associated in the provided content with Lazarus Group. The campaign used fictitious job offers and recruiter-themed social engineering, including spearphishing messages sent via LinkedIn, to trick targets into downloading malicious tools. The content states that Lazarus Group used compromised servers to host malware during the operation, used regsvr32 to execute malware, and placed LNK files in victims’ Startup folders for persistence. Post-compromise activity described in the content includes querying compromised victims’ Active Directory servers to obtain lists of employees, including administrator accounts, and conducting word searches within documents on compromised hosts for security and financial matters. The malware used in the campaign was described as being designed not to run on systems configured for Korean, Japanese, or Chinese in Windows language preferences. The content also states that Lazarus Group used a custom build of the open-source dbxcli command-line tool to exfiltrate stolen data to Dropbox. The campaign is noted as having tactical overlap with later North Korean activity such as Contagious Interview, but the content explicitly treats that as a separate activity cluster.