Lazarus Group Hunts European Drone Manufacturing Data

North Korea’s Lazarus Group is again targeting European drone manufacturers to steal proprietary information and manufacturing know-how, according to the report. ESET researchers have identified at least three organisations in Central and Southeastern Europe that Lazarus has struck so far, all involved in drone or related military equipment production.

The campaign’s primary payload is ScoringMathTea, a remote access Trojan that Lazarus actors have used since at least 2022, first surfacing on VirusTotal masquerading as an Airbus-themed job lure. ESET describes ScoringMathTea as able to run about 40 commands, enabling attackers to manipulate files, perform system reconnaissance, and download and execute additional payloads, with the group’s activity framed as part of a DreamJob operation.

The attacks align with North Korea’s efforts to scale its domestic drone programme by leveraging stolen data, a pattern highlighted by ESET in its assessment of the campaign.