Lazarus Hackers Goal European Drone Producers in Energetic Marketing campaign

The North Korean state-sponsored Lazarus hacking group has launched a classy cyberespionage marketing campaign concentrating on European protection contractors concerned in uncrewed aerial car (UAV) manufacturing.

The assaults seem straight linked to North Korea’s efforts to speed up its home drone manufacturing capabilities via industrial espionage.

The focused organizations embody a metallic engineering agency, an plane element producer, and a specialised protection firm, with a minimum of two closely concerned in UAV expertise improvement and manufacturing.

The marketing campaign represents a brand new wave of Operation DreamJob, Lazarus’s signature social engineering operation that makes use of pretend job presents at prestigious corporations as bait.

Beginning in late March 2025, ESET recognized a number of assaults concentrating on three defense-sector corporations throughout Southeastern and Central Europe.

Victims obtain fraudulent job descriptions alongside trojanized PDF readers, which ship malware when executed. This misleading tactic has confirmed remarkably efficient regardless of widespread safety consciousness campaigns.

The attackers deployed ScoringMathTea, a classy distant entry trojan (RAT) that has served as Lazarus’s payload of selection for 3 years.

BinMergeLoader leverages the Microsoft Graph API and makes use of Microsoft API tokens for authentication.

First noticed in October 2022, ScoringMathTea helps roughly 40 instructions, enabling attackers to control information and processes, accumulate system info, set up TCP connections, and execute downloaded payloads.

One dropper pattern found by researchers contained the inner identify “DroneEXEHijackingLoader.dll,” offering a direct hyperlink to the marketing campaign’s concentrate on UAV expertise theft.

The malware leverages DLL side-loading strategies and trojanizes reputable open-source tasks from GitHub together with TightVNC Viewer, MuPDF reader, and plugins for Notepad++ and WinMerge to evade detection.

ESET researchers famous important evolution within the group’s techniques, together with new DLL proxying libraries and improved collection of open-source tasks for trojanization.

The malware makes use of compromised WordPress servers for command-and-control communication, sometimes storing server elements inside theme or plugin directories.

The timing and goal choice strongly counsel the marketing campaign goals to steal proprietary UAV designs, manufacturing processes, and industrial know-how.

North Korea has invested closely in home drone capabilities, with latest reviews indicating Pyongyang is creating low-cost assault UAVs for potential export to African and Center Jap markets. Russia is reportedly aiding North Korea in producing knockoff Iranian Shahed suicide drones.

North Korea’s flagship reconnaissance drone, the Saetbyol-4, seems as a carbon copy of the Northrop Grumman RQ-4 World Hawk, whereas the Saetbyol-9 fight drone intently resembles Normal Atomics’ MQ-9 Reaper.

These designs show North Korea’s reliance on reverse engineering and mental property theft to advance its navy capabilities.

At the very least one focused firm manufactures vital elements for UAV fashions at present deployed in Ukraine, which North Korean forces could have encountered on the frontline in Russia’s Kursk area, the place North Korean troops had been deployed in 2025.

Moreover, the corporate is concerned in superior single-rotor drone improvement unmanned helicopter expertise that Pyongyang is actively creating however has not efficiently militarized.

Attribution and Broader Context

ESET attributed the assaults to Lazarus with excessive confidence primarily based on a number of indicators: the social engineering methodology, trojanization of GitHub open-source tasks for DLL side-loading, deployment of ScoringMathTea, and concentrating on of European aerospace and protection sectors.

Lazarus, often known as HIDDEN COBRA, is a complicated persistent menace (APT) group linked to North Korean intelligence providers and lively since a minimum of 2009.

The group is answerable for high-profile incidents together with the 2016 Sony Footage Leisure hack, tens-of-millions-of-dollar cyberheists, the 2017 WannaCry ransomware outbreak, and ongoing assaults towards South Korean infrastructure.

Safety consultants advocate protection contractors implement rigorous worker coaching on social engineering techniques, significantly pretend recruitment lures.

Organizations ought to scrutinize job presents from sudden sources, confirm executable information earlier than opening, and deploy superior endpoint detection options able to figuring out trojanized reputable software program.

Community segmentation and privileged entry administration can restrict lateral motion if preliminary compromise happens.

IoCs

Observe us on Google Information, LinkedIn, and X to Get Immediate Updates and Set GBH as a Most well-liked Supply in Google.