ESET researchers have uncovered a new, targeted wave of cyberespionage linked to the prolific Lazarus Group, an advanced persistent threat (APT) aligned with North Korea. Dubbed Operation DreamJob, the campaign has specifically targeted several European companies in the defense industry, with a strong focus on entities involved in the unmanned aerial vehicle (UAV) sector. This suggests the operation is likely connected to North Korea’s strategic efforts to rapidly scale up its drone program by stealing critical manufacturing know-how.
Operation DreamJob is characterized by sophisticated social engineering, primarily utilizing fake job offers for high-profile positions—the campaign’s namesake “dream job” lure—to gain initial access. Lazarus frequently targets the aerospace, defense, engineering, and technology sectors, with the primary goal being the theft of sensitive data, intellectual property, and proprietary information.
This recent wave, observed starting in late March 2025, honed in on three distinct European entities:
- A metal engineering company (Southeastern Europe).
- A manufacturer of aircraft components (Central Europe).
- A defense firm specializing in UAV software and components (Central Europe).
The targeting of organizations producing military equipment and critical drone components strongly reinforces the hypothesis that the UAV sector was the main cyberespionage objective.
The attackers successfully gained initial access partly through a technique involving trojanizing open-source projects on GitHub. They subsequently deployed their main payload: ScoringMathTea. This potent Remote Access Trojan (RAT) grants the attackers full control over the compromised machine, facilitating the theft of data. ScoringMathTea has been a key component of Operation DreamJob for three years, often using compromised servers (frequently hosted under WordPress folders) for its Command and Control (C&C) communications.
These recent global revelations have prompted a serious warning about regional vulnerability in West Africa. Olufemi Ake, Managing Director of ESET Nigeria, emphasized the rising risk to the local defense ecosystem, citing the current state of security in the region.
“It is an attractive region for cyberattacks,” Ake stated. He warned that with increasing digital connectivity, expanding defense partnerships, and emergence as a tech innovation hub, individuals and local organizations are now seen as potential entry points for both direct cyber threats and, crucially, indirect access to global supply chains.
Ake identified several sectors in West Africa currently at heightened risk:
- Government Agencies or institutions holding large citizen data.
- Key Sectors in Partnership with Government holding sensitive intellectual properties (e.g., engineering and technology firms).
- Critical Infrastructure operators (power, telecommunications, and finance).
- The defense, aerospace, and media industries.
To mitigate these risks and maintain resilience, Ake urged organizations to prioritize the education of staff and the deployment of robust security strategies. He specifically recommended:
- Integrating cybersecurity awareness training into all employee onboarding.
- Deploying robust device protection and advanced threat detection systems.
- Ensuring regular system updates.
Ake concluded with a broader appeal, calling on West African nations to treat cybersecurity as a strategic imperative. “Achieving this will require regional collaboration, sustained awareness campaigns, and long-term investment in cybersecurity capacity-building to safeguard national interests, economic growth, and public trust in digital systems.”