Operation ‘Dream Job’ Widespread North Korean Espionage Campaign

CSIS Significant Cyber Incidents

The Israeli defense ministry announced that it had successfully defended against a cyberattack on Israeli defense manufacturers launched by a suspected North Korean hacking group

ThaiCERT Threat Group Cards

Operation “Dream Job” Upon infection, the attackers collected intelligence regarding the company’s activity, and also its financial affairs, probably in order to try and steal some money from it. https://www.clearskysec.com/wp-content/uploads/2020/08/Dream-Job-Campaign.pdf

ThaiCERT Threat Group Cards

North Korean hackers are targeting Israel's defense sector, Israel Ministry of Defense claims https://www.cyberscoop.com/north-korea-hackers-lazarus-group-israel-defense/

CISSM Cyber Events Database (copy exported 21 Apr 2023, via github.com/holisticinfosec/CISSM-EDA)

Israel claimed Wednesday that it had thwarted a cyberattack by a North Korea-linked hacking group on its classified defense industry. However, security researchers at ClearSky said the hackers penetrated the computer systems and were likely to have stolen a large amount of classified data.

CFR Cyber Operations Tracker

Responsible for using social engineering and lofty job postings to coax employees into downloading malware that ultimately stole classified data.

Israel Ministry of Defense (DSDE/Malmab) statement, Aug 2020, as quoted by Globes (gov.il primary returned 403)

בהודעת משרד הביטחון נאמר כי "את ניסיון התקיפה ביצע על-פי החשד מערך סייבר בינלאומי המכונה 'לזרוס' (Lazarus), שמאחוריו עומדת מדינה זרה. אנשי המערך השתמשו בטכניקות שונות של 'הנדסה חברתית' והתחזות. הם בנו פרופילים מזויפים בלינקדאין, המשמשת בעיקר לחיפושי עבודה בעולמות ההייטק . התוקפים התחזו למנהלים, לבכירים במחלקות משאבי אנוש ולנציגי חברות בינלאומיות ופנו לעובדי תעשיות ביטחוניות מובילות בישראל בניסיון לפתח מולם שיח ולפתות אותם עם הצעות עבודה שונות".

Israel Ministry of Defense (DSDE/Malmab) statement, Aug 2020, as quoted by Globes (gov.il primary returned 403)

"ניסיונות התקיפה זוהו בזמן אמת וסוכלו על ידי היחידה הטכנולוגית של מלמ"ב במשרד הביטחון וע"י מערכות ההגנה בסייבר של התעשיות הביטחוניות, מבלי שנגרם נזק.

Check Point Research

The Israeli Defense Ministry has accused the North Korean related Lazarus APT group in targeting employees of major Israeli defense companies through fake LinkedIn profiles. Researchers said that unlike the group’s regular financially motivated attacks, the current campaign was focused on technology theft.

ClearSky Cyber Security

During June-August of 2020, ClearSky’s analysis team had investigated an offensive campaign attributed with high probability to North Korea, which we call “Dream Job”. This campaign has been active since the beginning of the year and it succeeded, in our assessment, to infect several dozens of companies and organizations in Israel and globally. Its main targets include defense, governmental companies, and specific employees of those companies. We assess this to be this year’s main offensive campaign by the Lazarus group, and it embodies the sum of the group’s accumulative knowledge on infiltration to companies and organizations around the globe.

Hackmageddon

Researchers from ClearSky reveal that hackers from North Korea were able to steal sensitive information from dozens of companies in the defense sector. The campaign is dubbed Dreamjob.

UN Panel of Experts S/2021/211

Para 126: “The Panel sought further information on cyberattacks against the defence industry of Israel based on publicly available information. A cybersecurity firm assessed this type of attack as the “main offensive campaign by the Lazarus group” in 2020 ... the attackers not only attempted to illegally access military technology but also sought to exfiltrate information that could be used for financial gain. After approaching targeted employees by impersonating human resources officers at prominent defence and aerospace companies, using fake accounts on a popular business-oriented social media site, ... The cybersecurity firm assessed that the attacks succeeded in infecting “several dozen companies and organizations” and illegally accessed classified data ...” (footnote 107: ClearSky Dream-Job-Campaign.pdf; footnote 110: Israel “had thwarted attacks from Lazarus”, 12 August 2020)

The Israeli defense ministry announced that it had successfully defended against a cyberattack on Israeli defense manufacturers launched by a suspected North Korean hacking group

This campaign has been active since the beginning of the year and it succeeded, in our assessment, to infect several dozens of companies and organizations in Israel and globally.

It said the attempt was made by “an international cyber group called ‘ Lazarus ,’ an organisation that is backed by a foreign country.”