Lazarus Hackers Goal European Drone Producers in Lively Marketing campaign

The North Korean state-sponsored Lazarus hacking group has launched a complicated cyberespionage marketing campaign concentrating on European protection contractors concerned in uncrewed aerial car (UAV) manufacturing.

The assaults seem instantly linked to North Korea’s efforts to speed up its home drone manufacturing capabilities by industrial espionage.

The focused organizations embrace a metallic engineering agency, an plane part producer, and a specialised protection firm, with a minimum of two closely concerned in UAV expertise improvement and manufacturing.

The marketing campaign represents a brand new wave of Operation DreamJob, Lazarus’s signature social engineering operation that makes use of faux job provides at prestigious corporations as bait.

Beginning in late March 2025, ESET recognized a number of assaults concentrating on three defense-sector corporations throughout Southeastern and Central Europe.

Victims obtain fraudulent job descriptions alongside trojanized PDF readers, which ship malware when executed. This misleading tactic has confirmed remarkably efficient regardless of widespread safety consciousness campaigns.

The attackers deployed ScoringMathTea, a complicated distant entry trojan (RAT) that has served as Lazarus’s payload of selection for 3 years.

BinMergeLoader leverages the Microsoft Graph API and makes use of Microsoft API tokens for authentication.

First noticed in October 2022, ScoringMathTea helps roughly 40 instructions, enabling attackers to control recordsdata and processes, accumulate system data, set up TCP connections, and execute downloaded payloads.

One dropper pattern found by researchers contained the inner identify “DroneEXEHijackingLoader.dll,” offering a direct hyperlink to the marketing campaign’s give attention to UAV expertise theft.

The malware leverages DLL side-loading strategies and trojanizes reliable open-source tasks from GitHub together with TightVNC Viewer, MuPDF reader, and plugins for Notepad++ and WinMerge to evade detection.

ESET researchers famous vital evolution within the group’s techniques, together with new DLL proxying libraries and improved collection of open-source tasks for trojanization.

The malware makes use of compromised WordPress servers for command-and-control communication, usually storing server parts inside theme or plugin directories.

The timing and goal choice strongly counsel the marketing campaign goals to steal proprietary UAV designs, manufacturing processes, and industrial know-how.

North Korea has invested closely in home drone capabilities, with current experiences indicating Pyongyang is creating low-cost assault UAVs for potential export to African and Center Jap markets. Russia is reportedly helping North Korea in producing knockoff Iranian Shahed suicide drones.

North Korea’s flagship reconnaissance drone, the Saetbyol-4, seems as a carbon copy of the Northrop Grumman RQ-4 International Hawk, whereas the Saetbyol-9 fight drone carefully resembles Basic Atomics’ MQ-9 Reaper.

These designs display North Korea’s reliance on reverse engineering and mental property theft to advance its army capabilities.

At the very least one focused firm manufactures vital parts for UAV fashions presently deployed in Ukraine, which North Korean forces could have encountered on the frontline in Russia’s Kursk area, the place North Korean troops had been deployed in 2025.

Moreover, the corporate is concerned in superior single-rotor drone improvement unmanned helicopter expertise that Pyongyang is actively creating however has not efficiently militarized.

Attribution and Broader Context

ESET attributed the assaults to Lazarus with excessive confidence based mostly on a number of indicators: the social engineering methodology, trojanization of GitHub open-source tasks for DLL side-loading, deployment of ScoringMathTea, and concentrating on of European aerospace and protection sectors.

Lazarus, also referred to as HIDDEN COBRA, is a complicated persistent menace (APT) group linked to North Korean intelligence providers and energetic since a minimum of 2009.

The group is accountable for high-profile incidents together with the 2016 Sony Photos Leisure hack, tens-of-millions-of-dollar cyberheists, the 2017 WannaCry ransomware outbreak, and ongoing assaults in opposition to South Korean infrastructure.

Safety consultants suggest protection contractors implement rigorous worker coaching on social engineering techniques, significantly faux recruitment lures.

Organizations ought to scrutinize job provides from surprising sources, confirm executable recordsdata earlier than opening, and deploy superior endpoint detection options able to figuring out trojanized reliable software program.

Community segmentation and privileged entry administration can restrict lateral motion if preliminary compromise happens.

IoCs

Observe us on Google Information, LinkedIn, and X to Get Immediate Updates and Set GBH as a Most popular Supply in Google.