North Korean Hackers Target UAV Industry to Steal Confidential Data

ESET researchers have uncovered a sophisticated cyberespionage campaign targeting European defence companies specialising in unmanned aerial vehicle technology. The attacks, attributed to the North Korea-aligned Lazarus group operating under Operation DreamJob, began observing in late March 2025 and targeted at least three European defence contractors across Southeastern and Central Europe.

The operation’s victims included a metal engineering firm, an aircraft component manufacturer, and a dedicated defence company involved in UAV development and production. The primary malware deployed is ScoringMathTea, a remote access trojan used by Lazarus in Operation DreamJob campaigns since late 2022, which supports around 40 distinct commands to steal data and maintain covert control.

A dropper with the internal DLL name DroneEXEHijackingLoader.dll points to a focus on UAV intellectual property theft, while trojanised versions of tools such as TightVNC Viewer and MuPDF were used throughout 2025. According to the report, Western defence contractors must strengthen recruitment verification and endpoint detection to counter these social-engineering and supply-chain-style attacks.