North Korean Threat Actors Target European Drone Makers

Researchers have identified a new wave of cybersecurity attacks against European drone makers by the Lazarus Group, a well-known and sophisticated threat actor group, allegedly sponsored by the North Korean government.

This campaign is the latest iteration of "Operation DreamJob," a long running series of social engineering and malware operations, designed to exfiltrate proprietary information and manufacturing know-how.

Overview of the Attack

Reports allege that Lazarus Group targeted at least three European drone makers using fake job postings for high-profile roles at major defence and aerospace firms. While this campaign is different from the DPRK IT Worker scheme conducted by a different North Korean group, it leverages some similar social engineering tactics. Attackers lured employees to open a PDF "job description" which were infected with malware. Once the PDFs were opened, the malware deployed a remote access trojan capable of issuing a variety of