CSIS entry 40 · October 2025
North Korean Lazarus APT group targeted three European defense sector companies to steal sensitive information on drone components and manufacturing processes. The attackers used a social engineering campaign, sending fake job offers with a remote access trojan. The targeted companies supply military equipment to Ukraine and possess specialized knowledge on advanced single-rotor drones that North Korea is actively developing.
27th October – Threat Intelligence Report · 2025-10-27
Several European defense manufacturers, including UAV/drone firms, have experienced a cyber-attack that resulted in ScoringMathTea RAT infections via trojanized GitHub projects and fake job-offer lures, enabling remote control and theft of proprietary UAV designs and manufacturing know-how. Corporate systems were compromised, and sensitive weapons-system data was likely exposed. The attack is attributed to North Korea–linked Lazarus group.
Gotta fly: Lazarus targets the UAV sector · 2025/10/23
ESET Research analyzes a recent cyberespionage campaign linked to Operation DreamJob, conducted by a North Korea-aligned Lazarus group.
country: Central and Southeastern Europe
The in-the-wild attacks successively targeted three companies active in the defense sector in Central and Southeastern Europe.
actors: Lazarus (Operation DreamJob)
Lazarus targeted several companies active in the defense industry in Central and Southeastern Europe.