Lazarus Hackers Goal European Drone Producers in Lively Marketing campaign

The North Korean state-sponsored Lazarus hacking group has launched a classy cyberespionage marketing campaign focusing on European protection contractors concerned in uncrewed aerial automobile (UAV) manufacturing.

The assaults seem straight linked to North Korea’s efforts to speed up its home drone manufacturing capabilities by industrial espionage.

The focused organizations embrace a steel engineering agency, an plane element producer, and a specialised protection firm, with at the least two closely concerned in UAV expertise improvement and manufacturing.

The marketing campaign represents a brand new wave of Operation DreamJob, Lazarus’s signature social engineering operation that makes use of faux job provides at prestigious firms as bait.

Beginning in late March 2025, ESET recognized a number of assaults focusing on three defense-sector firms throughout Southeastern and Central Europe.

Victims obtain fraudulent job descriptions alongside trojanized PDF readers, which ship malware when executed. This misleading tactic has confirmed remarkably efficient regardless of widespread safety consciousness campaigns.

The attackers deployed ScoringMathTea, a classy distant entry trojan (RAT) that has served as Lazarus’s payload of alternative for 3 years.

BinMergeLoader leverages the Microsoft Graph API and makes use of Microsoft API tokens for authentication.

First noticed in October 2022, ScoringMathTea helps roughly 40 instructions, enabling attackers to govern information and processes, gather system data, set up TCP connections, and execute downloaded payloads.

One dropper pattern found by researchers contained the interior title “DroneEXEHijackingLoader.dll,” offering a direct hyperlink to the marketing campaign’s give attention to UAV expertise theft.

The malware leverages DLL side-loading methods and trojanizes professional open-source initiatives from GitHub together with TightVNC Viewer, MuPDF reader, and plugins for Notepad++ and WinMerge to evade detection.

ESET researchers famous vital evolution within the group’s ways, together with new DLL proxying libraries and improved number of open-source initiatives for trojanization.

The malware makes use of compromised WordPress servers for command-and-control communication, usually storing server parts inside theme or plugin directories.

The timing and goal choice strongly recommend the marketing campaign goals to steal proprietary UAV designs, manufacturing processes, and industrial know-how.

North Korea has invested closely in home drone capabilities, with current studies indicating Pyongyang is creating low-cost assault UAVs for potential export to African and Center Jap markets. Russia is reportedly aiding North Korea in producing knockoff Iranian Shahed suicide drones.

North Korea’s flagship reconnaissance drone, the Saetbyol-4, seems as a carbon copy of the Northrop Grumman RQ-4 World Hawk, whereas the Saetbyol-9 fight drone intently resembles Common Atomics’ MQ-9 Reaper.

These designs show North Korea’s reliance on reverse engineering and mental property theft to advance its navy capabilities.

No less than one focused firm manufactures vital parts for UAV fashions at the moment deployed in Ukraine, which North Korean forces could have encountered on the frontline in Russia’s Kursk area, the place North Korean troops had been deployed in 2025.

Moreover, the corporate is concerned in superior single-rotor drone improvement unmanned helicopter expertise that Pyongyang is actively creating however has not efficiently militarized.

Attribution and Broader Context

ESET attributed the assaults to Lazarus with excessive confidence based mostly on a number of indicators: the social engineering methodology, trojanization of GitHub open-source initiatives for DLL side-loading, deployment of ScoringMathTea, and focusing on of European aerospace and protection sectors.

Lazarus, also referred to as HIDDEN COBRA, is a complicated persistent risk (APT) group linked to North Korean intelligence companies and lively since at the least 2009.

The group is liable for high-profile incidents together with the 2016 Sony Footage Leisure hack, tens-of-millions-of-dollar cyberheists, the 2017 WannaCry ransomware outbreak, and ongoing assaults towards South Korean infrastructure.

Safety consultants advocate protection contractors implement rigorous worker coaching on social engineering ways, notably faux recruitment lures.

Organizations ought to scrutinize job provides from surprising sources, confirm executable information earlier than opening, and deploy superior endpoint detection options able to figuring out trojanized professional software program.

Community segmentation and privileged entry administration can restrict lateral motion if preliminary compromise happens.

IoCs

Observe us on Google Information, LinkedIn, and X to Get Instantaneous Updates and Set GBH as a Most well-liked Supply in Google.