Loading story…
Researchers linked a targeted malware campaign to the Lazarus Group after attackers distributed malicious Microsoft Word files masquerading as Korean job postings, including a fake Cisco Korea systems engineer listing. The lure documents, including "Job Description.doc" and "Job Descriptions.doc", used heavily obfuscated VBA macros that required victims to enable macros before dropping a PE32 payload named jusched.exe, disguised as Java Update Scheduler, into %APPDATA%\Roaming. The documents also displayed a decoy job description to reduce suspicion while the malware executed in the background.
Analysis from ESRC and Cisco Talos found the malware used an XOR 0xE7 decryption routine, similar macro obfuscation, and reused command construction techniques previously seen in earlier Lazarus operations. The payload attempted to contact compromised legitimate websites over HTTP, including secuvision.co.kr, to retrieve follow-on commands or second-stage malware. Investigators tied the activity to prior Lazarus campaigns such as Operation Arabian Night, Coin Manager, and related 2017 job-themed intrusions, indicating a sustained pattern of using employment lures and compromised websites to gain initial access to targeted organizations.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
ESRC reported discovering the malicious Word document "Job Description.doc" and identified the activity as a Lazarus Group campaign it named "Operation Extreme Job." The lure was distributed via a Korean website associated with IP camera or CCTV sales and dropped jusched.exe plus a decoy job-description file if macros were enabled.
ESRC said the Lazarus-linked lure document was created around 9 p.m. on January 29, 2019, and the dropped malware was built at 2019-01-29 21:00:47 KST. The files were prepared as part of the campaign later named Operation Extreme Job.
Talos observed another related campaign using the filename "이력서_자기소개서.xls" as a lure. The November 2017 document used the same macro execution method and XOR key and contacted ilovesvc.com after dropping another PE32 executable.
Talos reported a related campaign using a ZIP archive named "주요 IT 정보보호 및 보안 업체 리스트.zip" containing an Office document. The sample used the same macros, XOR 0xe7 key, and dropped a PE32 file named jusched.exe while communicating with syadplus.com.
ESRC referenced a spear-phishing attack on a well-known Korean computer security company that used an HWP exploit instead of Office macros. The attack reportedly dropped jusched.exe, created a jusched.lnk startup shortcut, and reused C2 paths on ilovesvc.com and syadplus.com.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The North Korea-linked **Lazarus Group** expanded its long-running **Operation DreamJob** espionage campaign by using recruiter-themed lures, impersonation sites, and trojanized PDF software to compromise defense, aerospace, aviation, and UAV-related organizations in Europe, India, and other regions. Researchers said victims were sent tailored job descriptions through email, messaging platforms, and password-protected archives, then tricked into opening decoy documents with modified PDF readers that delivered malware including **ScoringMathTea**, **MISTPEN**, **ForestTiger**, and related loaders. ESET and Mandiant linked the activity to cyberespionage and theft of proprietary technology, with particular interest in drone manufacturing know-how and other sensitive defense-sector information. Check Point reported that the campaign escalated access by exploiting **`CVE-2026-68820`**, a zero-day local privilege escalation flaw in Microsoft **AFD.sys**, to deploy the **FudModule** rootkit with **SYSTEM** privileges and reduce endpoint detection visibility; Microsoft patched the issue on August 11, 2026. The operation also abused vulnerable **Roundcube** servers via **`CVE-2025-49113`** and installed the **RelayShell** PHP webshell to convert compromised web servers into command-and-control relay nodes, while compromised organizations were reused to spear-phish additional targets. Across the reporting, Lazarus showed a consistent pattern of evolving DreamJob tradecraft through trojanized open-source software, encrypted payload staging, DLL proxying, and use of trusted third-party infrastructure to improve stealth and credibility.
Aug 15, 2026
The **Lazarus Group** ran a spearphishing campaign that delivered malicious Microsoft Word documents to targets in aerospace, defense, research, and financial sectors, including organizations linked to Boeing, BAE Systems, Lockheed Martin, and the Republic of Korea Army. The infection chain used remote template injection to fetch an external `DOTM` file, whose macro dropped a lure document and a malicious DLL such as `onenote.db` into the victim’s `AppData` path, then executed the implant while showing a decoy file to reduce suspicion. Related reporting describes similar Lazarus lures sent in spoofed emails, with separate payloads for 32-bit and 64-bit systems and reconnaissance-focused first-stage malware. The implant executed through **`rundll32.exe`** and established persistence via the Windows **Startup folder**, techniques widely tracked in MITRE ATT&CK as `T1218.011` and `T1547.001`. Once active, it collected host, process, and disk information, compressed or encrypted the data, and exfiltrated it over HTTP POST using compromised or attacker-controlled infrastructure, including IIS/Plesk-hosted domains such as `elite4print.com` and `astedams.it`. Analysts linked the activity to Lazarus based on recurring tradecraft, lure themes, victim profiling, and overlap with operations such as **Operation Dream Job**, where the group similarly abused `rundll32.exe` and autostart mechanisms for stealthy execution and persistence.
Aug 15, 2026
Lazarus targeted South Korean organizations through watering-hole attacks and spearphishing, abusing vulnerable local security software including **INITECH INISAFE CrossWeb EX** and **DreamSecurity MagicLine** to gain initial access and execute malware. AhnLab linked one 2022 wave to a signed INITECH process, `inisafecrosswebexsvc.exe`, after a malicious `SCSKAppLink.dll` was injected to fetch additional payloads from attacker-controlled infrastructure. Across multiple campaigns, victims included defense, finance, media, IT, public-sector, manufacturing, logistics, and pharmaceutical organizations, with reports describing more than 100 incidents and repeated use of compromised Korean websites, IP filtering, staged loaders, DLL side-loading, Windows service abuse, and persistence via the LSA Security Packages registry path. After compromise, Lazarus deployed backdoors including **NukeSped** and in some cases escalated to kernel-level evasion using a **bring your own vulnerable driver** technique. AhnLab said the group abused the signed but vulnerable `ene.sys` driver, and in some variants Dell's `CVE-2021-21551` driver path, to obtain arbitrary kernel memory access and disable security controls in memory, including file and registry callbacks, process and thread monitoring, WFP network filters, and ETW tracing. The activity also involved lateral movement through WMI, and sometimes RDP or SSH, plus credential theft, keylogging, screen capture, SOCKS tunneling, port forwarding, and internal reconnaissance, underscoring a sustained espionage-focused campaign that also created opportunities for supply-chain access and financial theft.
Aug 15, 2026