Lazarus used fake job offers and a Windows zero-day to target defense and UAV firms
The North Korea-linked **Lazarus Group** expanded its long-running **Operation DreamJob** espionage campaign by using recruiter-themed lures, impersonation sites, and trojanized PDF software to compromise defense, aerospace, aviation, and UAV-related organizations in Europe, India, and other regions. Researchers said victims were sent tailored job descriptions through email, messaging platforms, and password-protected archives, then tricked into opening decoy documents with modified PDF readers that delivered malware including **ScoringMathTea**, **MISTPEN**, **ForestTiger**, and related loaders. ESET and Mandiant linked the activity to cyberespionage and theft of proprietary technology, with particular interest in drone manufacturing know-how and other sensitive defense-sector information.
Check Point reported that the campaign escalated access by exploiting **`CVE-2026-68820`**, a zero-day local privilege escalation flaw in Microsoft **AFD.sys**, to deploy the **FudModule** rootkit with **SYSTEM** privileges and reduce endpoint detection visibility; Microsoft patched the issue on August 11, 2026. The operation also abused vulnerable **Roundcube** servers via **`CVE-2025-49113`** and installed the **RelayShell** PHP webshell to convert compromised web servers into command-and-control relay nodes, while compromised organizations were reused to spear-phish additional targets. Across the reporting, Lazarus showed a consistent pattern of evolving DreamJob tradecraft through trojanized open-source software, encrypted payload staging, DLL proxying, and use of trusted third-party infrastructure to improve stealth and credibility.
Aug 14, 2026
Lazarus Spearphishing Campaign Used Word Templates, Rundll32, and Startup Persistence
The **Lazarus Group** ran a spearphishing campaign that delivered malicious Microsoft Word documents to targets in aerospace, defense, research, and financial sectors, including organizations linked to Boeing, BAE Systems, Lockheed Martin, and the Republic of Korea Army. The infection chain used remote template injection to fetch an external `DOTM` file, whose macro dropped a lure document and a malicious DLL such as `onenote.db` into the victim’s `AppData` path, then executed the implant while showing a decoy file to reduce suspicion. Related reporting describes similar Lazarus lures sent in spoofed emails, with separate payloads for 32-bit and 64-bit systems and reconnaissance-focused first-stage malware.
The implant executed through **`rundll32.exe`** and established persistence via the Windows **Startup folder**, techniques widely tracked in MITRE ATT&CK as `T1218.011` and `T1547.001`. Once active, it collected host, process, and disk information, compressed or encrypted the data, and exfiltrated it over HTTP POST using compromised or attacker-controlled infrastructure, including IIS/Plesk-hosted domains such as `elite4print.com` and `astedams.it`. Analysts linked the activity to Lazarus based on recurring tradecraft, lure themes, victim profiling, and overlap with operations such as **Operation Dream Job**, where the group similarly abused `rundll32.exe` and autostart mechanisms for stealthy execution and persistence.
Jan 27, 2022
LinkedIn Resume Phishing Delivered More_eggs Malware to Recruiters and Hiring Staff
Security firms reported multiple spearphishing campaigns that used LinkedIn job applications, fake job offers, and poisoned resumes to deliver the **More_eggs** malware to recruiters, hiring managers, and other business professionals. In observed intrusions, victims were directed through legitimate-looking resume workflows that ended with a malicious archive or shortcut file, often disguised as a document, which launched obfuscated activity and installed the JavaScript-based backdoor. The campaigns were seen across sectors including industrial services, aerospace and defense, legal, accounting, staffing, and healthcare technology, showing a sustained focus on personnel involved in recruiting and hiring.
The malware and delivery chain were linked to **Golden Chickens** (also known as **Venom Spider**) and associated tooling such as **VenomLNK**, **TerraLoader**, and **TerraPreter**, though the specific operators behind individual incidents were not always confirmed. The attacks abused signed Windows binaries including **`regsvr32`**, **`wmic`**, **`msxsl.exe`**, **`ie4uinit.exe`**, and in earlier cases **`cmstp`** to evade detection, establish execution, perform discovery, and communicate with command-and-control infrastructure. Defenders said **More_eggs** can support credential theft, data exfiltration, lateral movement, remote access, and follow-on ransomware activity, and in at least one case endpoint telemetry caught suspicious XSL script processing and related malicious behavior before the intrusion succeeded.
Sep 7, 2019
