North Korea’s Operation DreamJob Hits Europe: WhatsApp Job Lure Delivers Evolved MISTPEN/BURNBOOK Backdoors

Orange Cyberdefense has reported a new wave of Operation DreamJob attacks linked to North Korean threat actor UNC2970, targeting a European manufacturing subsidiary via fraudulent job offers on WhatsApp. The campaign utilizes advanced malware variants, particularly BURNBOOK and MISTPEN, with a focus on social engineering tactics. The attack begins with a WhatsApp message leading to a malicious ZIP file containing a PDF and a trojanized DLL, initiating a sophisticated attack chain.

The malware employs DLL sideloading and pass-the-hash techniques for lateral movement within networks. The report highlights the evolution of the malware, including new opcodes for enhanced stealth and operational flexibility, making detection challenging for defenders. Despite its longevity, DreamJob's attacks remain difficult to trace due to the complexity and variety of its malware ecosystem.