Summary Points
- North Korean-linked threat actors, specifically the Lazarus Group, are conducting a long-running campaign called Operation Dream Job, targeting European defense and UAV companies to steal proprietary information using malware like ScoringMathTea and MISTPEN.
- The campaign predominantly uses social engineering—luring targets with fake job offers—to infect systems with trojanized documents, leading to remote access Trojans (RATs) enabling full control over compromised devices.
- Attackers leverage sophisticated malware delivery involving loaders such as BinMergeLoader, employing methods like Microsoft Graph API tokens, to evade detection and deploy advanced payloads, including polymorphic variants of ScoringMathTea.
- Since 2020, Lazarus Group has maintained a consistent modus operandi, trojanizing open-source apps and utilizing similar attack techniques to persistently infiltrate organizations, especially in the defense and aerospace sectors.
What’s the Problem?
In late March 2025, a covert campaign known as Operation Dream Job, linked to North Korean hacking groups like Lazarus, targeted European defense-related companies, especially those involved in UAV development, with the aim of stealing sensitive proprietary information. Cybercriminals employed deceptive social engineering tactics—primarily offering fake job opportunities—to lure employees into opening malicious files. Once an infected document was opened, malware such as ScoringMathTea and MISTPEN was deployed to facilitate remote access and data exfiltration, with threat actors using sophisticated tools like the BinMergeLoader and malicious DLLs to evade detection and maintain persistence.
This ongoing campaign, first uncovered by cybersecurity firm ESET in March 2025, is part of a long-standing operation originally exposed in 2020 by Israeli cybersecurity firm ClearSky. The Lazarus Group has consistently used high-level deception and polymorphic malware strategies to infiltrate target systems, reflecting a persistent effort to bolster North Korea’s drone program and military capabilities. The report reveals that the attackers’ methods involve a predictable yet effective sequence of social engineering and malware deployment, allowing them to continuously bypass security defenses and steal valuable technological intelligence from highly targeted industries across Europe.
What’s at Stake?
The threat posed by North Korean hackers using fake job offers to deceive defense engineers into revealing sensitive drone technology is not confined to national defense alone; it poses a significant risk to any business engaged in advanced technology or intellectual property. Such targeted cyber-espionage campaigns could lead to the theft of proprietary designs, trade secrets, or innovative processes, exposing your business to severe competitive disadvantages, financial loss, and reputational damage. If your company inadvertently fall prey to these sophisticated scams, attackers could gain invaluable insights into your technological edge, potentially enabling them to replicate or undermine your market position—damage that could be both immediate and long-term, undermining your strategic initiatives and eroding stakeholder trust.
Fix & Mitigation
In an era where cyber threats evolve rapidly, prompt remediation is critical to prevent significant breaches, especially when malicious actors like North Korean hackers target defense engineers with fake job offers to extract sensitive drone technology secrets. Swift action minimizes damage, thwarts ongoing attacks, and safeguards national security interests.
Detection and Analysis
- Monitor and analyze network traffic for unusual patterns or unauthorized access
- Conduct threat intelligence sharing to identify known malicious tactics, techniques, and procedures (TTPs)
Containment
- Isolate affected systems to prevent lateral movement
- Temporarily disable compromised accounts or services involved in the attack
Eradication
- Remove malicious files, malware, or backdoors from affected systems
- Patch vulnerabilities exploited during the attack, including weak authentication or unpatched software
Recovery
- Restore systems from clean backups ensuring integrity and confidentiality
- Enforce heightened security measures before restoring full operational status
Communication
- Notify relevant stakeholders and authorities about the breach in accordance with legal and policy requirements
- Provide awareness training to defense engineers on recognizing phishing or fake job communications
Prevention
- Implement multi-factor authentication for access to sensitive data
- Regularly update and patch systems to close vulnerabilities
- Conduct simulated phishing exercises to strengthen staff awareness
- Develop and enforce strict verification protocols for employment or contractual engagements
Continue Your Cyber Journey
Discover cutting-edge developments in Emerging Tech and industry Insights.
Learn more about global cybersecurity standards through the NIST Cybersecurity Framework.
Disclaimer: The information provided may not always be accurate or up to date. Please do your own research, as the cybersecurity landscape evolves rapidly. Intended for secondary references purposes only.
Cyberattacks-V1cyberattack-v1-multisource
