Lazarus targets European defense firms in UAV-themed Operation DreamJob

Lazarus, the North Korea-linked APT group, has targeted three European defence firms through Operation DreamJob, using fake recruiter profiles to lure UAV technology staff and gain access to sensitive information. The operation, active since at least 2020, has involved social engineering and fake job offers as the lure, with new attacks observed from March 2025 targeting a metal engineering company, an aircraft parts maker, and a defence contractor.

ESET reports that the operators gained access via trojanised PDFs and deployed the ScoringMathTea RAT for full control, noting that main implants are never stored unencrypted on disk. The campaign appears to focus on UAV technology data to support North Korea’s drone development, with links to Russia in the Ukraine war context and the use of two-tier tool suites in 2025.

Submissions have come from Italy and Spain, and the group has previously carried out operations involving Trojanised open-source apps and multiple loaders that decrypt AES-128/ChaCha20 payloads. According to ESET’s report, the operation has demonstrated polymorphism to evade detection, while employee awareness in sensitive sectors remains insufficient to mitigate the risk of a suspicious hiring process.