Based

<a href="https://www.eset.com/uk/research/?srsltid=AfmBOorm74KBsNdoXg-PeVDeXi0DgCK1J_z4B4dIjjPmNiI6J0oWqcmH" target="_blank" rel="noopener noreferrer nofollow">ESET researchers</a> have recently observed a new instance of Operation DreamJob, a campaign that we track under the umbrella of North Korea-aligned Lazarus, in which several European companies active in the defense industry were targeted. Some of these are heavily involved in the unmanned aerial vehicle (UAV) sector, suggesting that the operation may be linked to North Korea’s current efforts&nbsp;to scale&nbsp;up&nbsp;its drone program.
This&nbsp;blogpost&nbsp;discusses&nbsp;the&nbsp;broader&nbsp;geopolitical&nbsp;implications&nbsp;of the campaign and provides a high-level overview of the toolset used by the attackers. Lazarus attacks against companies developing UAV technology align with recently reported developments in the North Korean drone program.
The suspected primary goal of the attackers was likely the theft of proprietary information and manufacturing know-how. Based on the social-engineering technique used for initial access, trojanizing open-source projects from GitHub, and the deployment of ScoringMathTea, ESET Research considers these attacks to be a new wave of the Operation DreamJob campaign.
Operation DreamJob is a codename for Lazarus campaigns that rely primarily on social engineering, specifically&nbsp;using&nbsp;fake&nbsp;job&nbsp;offers&nbsp;for&nbsp;prestigious&nbsp;or&nbsp;high-profile&nbsp;positions&nbsp;(the&nbsp;“dream&nbsp;job”&nbsp;lure).
<div class="wp-block-image">
 <figure class="aligncenter size-full">
 <img loading="lazy" width="810" height="464" src="https://technext24.com/wp-content/uploads/2025/10/ESET-office.jpg" alt="Operation DreamJob: ESET&nbsp;Research&nbsp;analyzes recent&nbsp;cyberespionage campaign&nbsp;linked&nbsp;to Lazarus Group">
 </figure>
</div>
Targets are predominantly in the aerospace and defence sectors, followed by engineering and technology companies, and the media and entertainment sector primary goal is cyberspionage, focusing on stealing sensitive data, intellectual property, and proprietary information, and the secondary goal is financial gain.
Starting in late March 2025, we observed in ESET telemetry cyberattacks reminiscent of Operation DreamJob&nbsp;campaigns.
The&nbsp;in-the-wild&nbsp;attacks&nbsp;successively&nbsp;targeted&nbsp;three&nbsp;European&nbsp;companies&nbsp;active in&nbsp;the&nbsp;defense&nbsp;sector.&nbsp;Although&nbsp;their&nbsp;activities&nbsp;are&nbsp;somewhat diverse,&nbsp;these&nbsp;entities&nbsp;can&nbsp;be&nbsp;described&nbsp;as:
·&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;a&nbsp;metal&nbsp;engineering&nbsp;company&nbsp;(Southeastern&nbsp;Europe),
·&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;a&nbsp;manufacturer&nbsp;of&nbsp;aircraft&nbsp;components&nbsp;(Central&nbsp;Europe),&nbsp;and
·&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;a&nbsp;defense&nbsp;company&nbsp;(Central&nbsp;Europe).
The main payload deployed to the targets was ScoringMathTea, a RAT that offers the attackers full control&nbsp;over&nbsp;the&nbsp;compromised&nbsp;machine.
Its&nbsp;first&nbsp;appearance&nbsp;dates&nbsp;to&nbsp;late&nbsp;2022,&nbsp;when&nbsp;its&nbsp;dropper&nbsp;was uploaded&nbsp;to&nbsp;VirusTotal.&nbsp;Soon&nbsp;after,&nbsp;it&nbsp;was&nbsp;seen&nbsp;in&nbsp;the&nbsp;wild,&nbsp;and&nbsp;since&nbsp;then&nbsp;in&nbsp;multiple&nbsp;attacks&nbsp;attributed to Lazarus’ Operation DreamJob campaigns, which makes it the attacker’s payload of choice for already&nbsp;three&nbsp;years.
It&nbsp;uses&nbsp;compromised&nbsp;servers&nbsp;for&nbsp;C&amp;C&nbsp;communication,&nbsp;with&nbsp;the&nbsp;server&nbsp;part&nbsp;usually stored under the WordPress folder containing design templates or plugins.
The&nbsp;three&nbsp;targeted&nbsp;organisations&nbsp;manufacture&nbsp;different&nbsp;types&nbsp;of&nbsp;military&nbsp;equipment&nbsp;(or&nbsp;parts&nbsp;thereof), many of which are currently deployed in Ukraine as a result of European countries’ military assistance.
At least two of these organisations are clearly involved in the development of UAV technology, with one manufacturing critical components and the other reportedly engaged in the design of UAV-related software.
Some&nbsp;technical&nbsp;artefacts&nbsp;observed&nbsp;in&nbsp;threat&nbsp;actors’&nbsp;droppers&nbsp;significantly&nbsp;reinforce&nbsp;the hypothesis&nbsp;that precisely the UAV sector was their main cyberspionage goal.
Responding to these recent revelations of global cyberespionage campaigns by ESET, Olufemi Ake, Managing Director&nbsp;of&nbsp;ESET&nbsp;Nigeria, has&nbsp;raised concerns&nbsp;over&nbsp;the growing vulnerability in&nbsp;the&nbsp;defense ecosystem, going by the current state of security in the region, particularly West Africa.
“It is an attractive region for cyberattacks,”&nbsp;Ake stated.&nbsp;“With the increasing digital connectivity, expansion of defence partnerships, and emergence as a numerous tech innovation hub, individualsare&nbsp;now&nbsp;seen&nbsp;as&nbsp;potential&nbsp;entry&nbsp;points&nbsp;for&nbsp;both&nbsp;direct&nbsp;cyber&nbsp;threats&nbsp;and&nbsp;indirect&nbsp;access&nbsp;to&nbsp;global&nbsp;supply chains as it relates to the security situation in certain pocket areas.”
<div class="wp-block-image">
 <figure class="aligncenter size-full">
 <img loading="lazy" width="1200" height="701" src="https://technext24.com/wp-content/uploads/2025/10/ESET-new-logo.png" alt="Operation DreamJob: ESET&nbsp;Research&nbsp;analyzes recent&nbsp;cyberespionage campaign&nbsp;linked&nbsp;to Lazarus Group">
 </figure>
</div>
He identified several sectors currently at heightened risk, including government agencies or institutions with large data of citizens, key sectors in partnership with the government, holding sensitive intellectual properties, such as engineering and technology firms, critical infrastructure operators such as power, telecommunications, and finance, as well as the defence, aerospace, and media industries.
To mitigate these risks, Ake emphasised the importance of integrating cybersecurity awareness training into employee onboarding processes.
He urged organisations to prioritise the education of staff, the deployment of robust device protection, and the implementation of advanced threat detection systems, alongside regular system updates.
These, he noted, are essential strategies to maintain resilience and stay ahead of the evolving threat landscape.
In&nbsp;a&nbsp;broader&nbsp;appeal,&nbsp;Ake&nbsp;called&nbsp;on&nbsp;West&nbsp;African&nbsp;nations&nbsp;to&nbsp;treat&nbsp;cybersecurity&nbsp;as&nbsp;a&nbsp;strategic&nbsp;imperative at the helm of affairs.
“As countries across the region continue their digital transformation journeys, cyber resilience must be made a top priority,”&nbsp;he said.&nbsp;“Achieving this will require regional collaboration, sustained awareness campaigns, and long-term investment in cybersecurity capacity- building to safeguard national interests, economic growth, and public trust in digital systems.”
See also: <a href="https://technext24.com/2025/10/23/lidya-shuts-down-over-financial-distress/" rel="noopener noreferrer nofollow">Lending startup Lidya shuts down over ‘severe financial distress’</a>

Operation DreamJob: ESET Research analyses recent cyberespionage campaign linked to Lazarus Group

Technext.ng

Other articles published on Oct 23, 2025

Join our free newsletter for daily crypto updates!