Loading story…
Researchers reported that the North Korea-linked Lazarus Group conducted Amazon-themed phishing campaigns targeting victims in the Netherlands and Belgium. The operation used lures impersonating Amazon to trick recipients into opening malicious content, continuing Lazarus’s pattern of blending social engineering with malware delivery to gain access to targeted systems.
The activity highlights Lazarus’s use of trusted consumer brands to improve the credibility of phishing emails and increase the likelihood of compromise. By tailoring the campaign to local targets in Western Europe, the attackers demonstrated a focused effort to harvest credentials or deploy malware through convincing retail-themed messages tied to Amazon branding.
Get the infrastructure and lures behind it.
1 event from the most recent confirmed update back to the earliest known activity.
ESET publicly reported on Amazon-themed campaigns attributed to the Lazarus Group targeting victims in Belgium and the Netherlands. The reference provides no earlier dated events, so the publication date is used as the event date.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The North Korea-linked **Lazarus Group** expanded its long-running **Operation DreamJob** espionage campaign by using recruiter-themed lures, impersonation sites, and trojanized PDF software to compromise defense, aerospace, aviation, and UAV-related organizations in Europe, India, and other regions. Researchers said victims were sent tailored job descriptions through email, messaging platforms, and password-protected archives, then tricked into opening decoy documents with modified PDF readers that delivered malware including **ScoringMathTea**, **MISTPEN**, **ForestTiger**, and related loaders. ESET and Mandiant linked the activity to cyberespionage and theft of proprietary technology, with particular interest in drone manufacturing know-how and other sensitive defense-sector information. Check Point reported that the campaign escalated access by exploiting **`CVE-2026-68820`**, a zero-day local privilege escalation flaw in Microsoft **AFD.sys**, to deploy the **FudModule** rootkit with **SYSTEM** privileges and reduce endpoint detection visibility; Microsoft patched the issue on August 11, 2026. The operation also abused vulnerable **Roundcube** servers via **`CVE-2025-49113`** and installed the **RelayShell** PHP webshell to convert compromised web servers into command-and-control relay nodes, while compromised organizations were reused to spear-phish additional targets. Across the reporting, Lazarus showed a consistent pattern of evolving DreamJob tradecraft through trojanized open-source software, encrypted payload staging, DLL proxying, and use of trusted third-party infrastructure to improve stealth and credibility.
Aug 15, 2026
Researchers linked a targeted malware campaign to the **Lazarus Group** after attackers distributed malicious Microsoft Word files masquerading as Korean job postings, including a fake Cisco Korea systems engineer listing. The lure documents, including **"Job Description.doc"** and **"Job Descriptions.doc"**, used heavily obfuscated VBA macros that required victims to enable macros before dropping a PE32 payload named **`jusched.exe`**, disguised as **Java Update Scheduler**, into **`%APPDATA%\Roaming`**. The documents also displayed a decoy job description to reduce suspicion while the malware executed in the background. Analysis from ESRC and Cisco Talos found the malware used an **XOR `0xE7`** decryption routine, similar macro obfuscation, and reused command construction techniques previously seen in earlier Lazarus operations. The payload attempted to contact compromised legitimate websites over HTTP, including **`secuvision.co.kr`**, to retrieve follow-on commands or second-stage malware. Investigators tied the activity to prior Lazarus campaigns such as **Operation Arabian Night**, **Coin Manager**, and related 2017 job-themed intrusions, indicating a sustained pattern of using employment lures and compromised websites to gain initial access to targeted organizations.
Aug 15, 2026
North Korea-linked **Lazarus Group** (aka **Diamond Sleet**) has been reported using **Medusa** ransomware in at least one intrusion targeting an unnamed organization in the Middle East, with an additional, reportedly unsuccessful attempt against a U.S. healthcare organization. The activity was attributed by Broadcom’s Symantec/Carbon Black threat research, which noted Medusa is a **ransomware-as-a-service (RaaS)** operation launched in 2023 by a cybercrime group known as **Spearwing**; analysis of Medusa’s leak site also indicates numerous recent U.S. healthcare/non-profit victims, though it is unclear which were directly targeted by North Korean operators versus other Medusa affiliates. The reporting frames this as part of a broader trend of North Korean operators shifting from bespoke ransomware to leveraging “off-the-shelf” ransomware ecosystems. Separately, Lazarus was also linked to a **social-engineering** operation targeting the CEO of security firm *AllSecure* via a **fake LinkedIn recruiting workflow** that led to a staged “technical interview.” The lure attempted to convince the target to download and open a code project in *VS Code*, which AllSecure’s analysis said contained multiple infection paths and delivered **BeaverTail** malware; the victim avoided compromise by refusing to run the files on their primary system and instead detonating them in an isolated environment. While both reports attribute activity to Lazarus, they describe **distinct operations** (ransomware deployment vs. recruiter/interview malware delivery) rather than a single unified incident.
Jun 29, 2026