North Korean Hackers Lure Defense Engineers With Fake Jobs to Steal Drone Secrets

Threat actors tied to North Korea have been attributed with a new wave of attacks on European defence-industry firms, using fake job offers to lure defence engineers and steal drone secrets as part of Operation Dream Job. The campaign, observed by ESET researchers, began in late March 2025 and targets include a metal engineering company in Southeastern Europe, a Central European aircraft components maker, and a defence company in Central Europe.

The attackers deploy malware families such as ScoringMathTea and MISTPEN, with a downloader named BinMergeLoader that uses Microsoft Graph API to fetch additional payloads; some infection chains also load two interim payloads before delivering ScoringMathTea, an advanced RAT capable of around 40 commands. ScoringMathTea was previously observed by ESET in 2023 and dates back to October 2022, while MISTPEN was documented by Google Mandiant in September 2024 as part of intrusions into energy and aerospace sectors.

In these attacks, the social engineering lure resembles Contagious Interview, offering lucrative job opportunities and delivering trojanised PDFs to trigger malware execution, according to ESET. The Lazarus Group, also known as APT-Q-1, Black Artemis, Diamond Sleet (formerly Zinc), Hidden Cobra, TEMP[.]Hermit, and UNC2970, is the prolific North Korean hacking collective behind Operation Dream Job.