ESET WeLiveSecurity
ESET APT Activity Report Q4 2025–Q1 2026 (DPRK-related paragraph 2) · 2026/05/28
We also tracked the continuing evolution of Lazarus campaigns, including Operation DreamJob and Operation DangerousPassword. The former targeted European drone manufacturers; the latter led to the compromise of the widely used JavaScript library axios, which has over 100 million weekly downloads on the npm registry and is critical to web and mobile applications worldwide. Attackers exploited the lead maintainer’s compromised credentials to publish malicious versions of the library that injected trojanized code into affected systems, before being detected and removed. In parallel, ScarCruft compromised a gaming platform serving the Yanbian region in China, likely to collect intelligence on individuals of interest to the North Korean regime, including refugees and defectors.