Loading story…
North Korea's Lazarus Group conducted a cyberespionage campaign against multiple European defense contractors specializing in drone and unmanned aerial vehicle (UAV) technology. ESET researchers identified at least three organizations in Central and Southeastern Europe that were targeted, with the attackers using sophisticated social engineering tactics, including fake job offers, to gain initial access. The campaign, assessed as a new wave of Operation DreamJob, aimed to steal proprietary manufacturing data and sensitive know-how, aligning with North Korea's efforts to advance its domestic drone program.
The attackers deployed a remote-access trojan (RAT) known as ScoringMathTea after compromising victims, granting them control over infected systems and facilitating data exfiltration. The targeted companies produce military equipment, some of which is being used in Ukraine, suggesting the operation may have also sought intelligence on Western-made weapons systems deployed in the ongoing conflict. The campaign highlights Lazarus Group's continued use of job-themed lures and its strategic focus on acquiring advanced defense technologies for Pyongyang's military ambitions.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
As part of its public reporting, ESET released indicators of compromise covering malware components and domains associated with the Lazarus operation to help defenders detect related activity.
On October 23, 2025, ESET disclosed and attributed the campaign to North Korea's Lazarus Group as a new iteration of Operation DreamJob targeting European drone and defense manufacturers. The report described the espionage objective, victim profile, malware, and evasion techniques.
After initial compromise, Lazarus deployed multi-stage tooling including ScoringMathTea RAT and, in some cases, BinMergeLoader (MISTPEN), giving operators interactive remote control, reconnaissance capability, and a path to data theft and follow-on payload delivery.
To gain access, Lazarus used fake job offers, trojanized PDF reader documents, and modified open-source applications, then employed DLL sideloading/proxying and in-memory decryption to load malware while evading detection.
During the 2025 campaign, Lazarus compromised at least three defense-sector organizations in Central and Southeastern Europe, including companies involved in UAV development and manufacturers whose equipment is used in Ukraine.
Beginning in March 2025, Lazarus launched a new Operation DreamJob wave targeting European defense and drone-related companies with fake recruitment lures. The campaign focused on stealing proprietary manufacturing data and know-how, especially related to UAV technology.
ESET noted that the ScoringMathTea remote access trojan used in this campaign was first seen in 2022 and has remained a core Lazarus payload with only limited changes over time.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
8 references tracked. Mallory keeps watching after this page renders.
therecord.media
Open sourcecsoonline.com
Open sourcebleepingcomputer.com
Open sourcethehackernews.com
Open sourcedarkreading.com
Open sourcecyberscoop.com
Open sourcesecurityaffairs.com
Open sourcehelpnetsecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The North Korea-linked **Lazarus Group** expanded its long-running **Operation DreamJob** espionage campaign by using recruiter-themed lures, impersonation sites, and trojanized PDF software to compromise defense, aerospace, aviation, and UAV-related organizations in Europe, India, and other regions. Researchers said victims were sent tailored job descriptions through email, messaging platforms, and password-protected archives, then tricked into opening decoy documents with modified PDF readers that delivered malware including **ScoringMathTea**, **MISTPEN**, **ForestTiger**, and related loaders. ESET and Mandiant linked the activity to cyberespionage and theft of proprietary technology, with particular interest in drone manufacturing know-how and other sensitive defense-sector information. Check Point reported that the campaign escalated access by exploiting **`CVE-2026-68820`**, a zero-day local privilege escalation flaw in Microsoft **AFD.sys**, to deploy the **FudModule** rootkit with **SYSTEM** privileges and reduce endpoint detection visibility; Microsoft patched the issue on August 11, 2026. The operation also abused vulnerable **Roundcube** servers via **`CVE-2025-49113`** and installed the **RelayShell** PHP webshell to convert compromised web servers into command-and-control relay nodes, while compromised organizations were reused to spear-phish additional targets. Across the reporting, Lazarus showed a consistent pattern of evolving DreamJob tradecraft through trojanized open-source software, encrypted payload staging, DLL proxying, and use of trusted third-party infrastructure to improve stealth and credibility.
Aug 12, 2026
North Korea–aligned operators, including **Lazarus** (aka **HIDDEN COBRA**), are running multiple social-engineering-led intrusion campaigns aimed at stealing sensitive technology and establishing durable access. Reporting on **Operation DreamJob** describes fake job-offer lures used to compromise European drone manufacturers and defense contractors, with tooling and infrastructure designed to evade traditional defenses and support cyber-espionage against UAV-related intellectual property. Separately, a developer-focused operation dubbed **“Fake Font”** uses fake recruiter outreach and malicious GitHub repositories to trick engineers into opening projects that abuse *Visual Studio Code* automation (via `.vscode/tasks.json`) and disguised payloads (e.g., `.woff2` “font” files) to execute multi-stage malware that ultimately deploys the **InvisibleFerret** Python backdoor for credential and crypto-wallet theft and long-term access. A distinct DPRK-linked campaign reported by Darktrace targets South Korean users with spear-phishing that delivers a JSE script masquerading as an HWPX document and then abuses **VS Code tunnels** as a covert C2 channel over trusted Microsoft infrastructure, complicating detection in developer-heavy environments. Other items in the set describe unrelated activity: phishing abuse of *Vercel* to deliver remote-access tooling, exploitation of **CVE-2025-51683** (blind SQLi) in the *Mjobtime* time-tracking app to reach MSSQL `xp_cmdshell`, a hospitality-focused **DCRat** campaign using **ClickFix** and `MSBuild.exe`, a generic CSS exfiltration technique write-up, and Trend Micro research on the **PeckBirdy** LOLBins framework used by China-aligned intrusion sets—none of which are part of the DPRK developer/defense recruitment-themed operations above.
Jun 29, 2026
Security researchers have uncovered and documented a sophisticated scheme by North Korea's Lazarus Group, specifically its Famous Chollima division, to infiltrate Western companies by recruiting remote IT workers under false pretenses. The operation involves North Korean agents posing as recruiters who target engineers and developers, convincing them to rent out their identities and computers. These compromised individuals act as figureheads, allowing Lazarus operatives to pass interviews, gain employment, and use the victims' devices as proxies to conceal their true location and activities. Researchers, including Mauro Eldritch of BCA LTD and the NorthScan initiative, managed to capture the scheme live by deploying controlled sandbox environments that mimicked real developer laptops, enabling them to observe the attackers' tactics in real time. The scheme leverages social engineering, AI-driven interview techniques, and deepfake technology to bypass security checks and secure positions at high-profile companies, particularly in finance, crypto, healthcare, and engineering sectors. Victims are offered a share of the salary, typically 20-35%, in exchange for their cooperation, but they bear all legal and reputational risks if the operation is discovered. The investigation also revealed that Lazarus operatives spammed GitHub repositories with recruitment messages to attract more candidates. This exposure provides critical insight into North Korea's ongoing efforts to generate revenue and conduct espionage through remote access to Western corporate networks.
Jun 29, 2026