Lazarus Hackers Target European Drone Manufacturers in Active Campaign

The North Korean state-sponsored Lazarus hacking group has launched a sophisticated cyberespionage campaign targeting European defense contractors involved in uncrewed aerial vehicle (UAV) manufacturing.

The attacks appear directly linked to North Korea’s efforts to accelerate its domestic drone production capabilities through industrial espionage.

The targeted organizations include a metal engineering firm, an aircraft component manufacturer, and a specialized defense company, with at least two heavily involved in UAV technology development and production.

The campaign represents a new wave of Operation DreamJob, Lazarus’s signature social engineering operation that uses fake job offers at prestigious companies as bait.

Starting in late March 2025, ESET identified multiple attacks targeting three defense-sector companies across Southeastern and Central Europe.

Victims receive fraudulent job descriptions alongside trojanized PDF readers, which deliver malware when executed. This deceptive tactic has proven remarkably effective despite widespread security awareness campaigns.

The attackers deployed ScoringMathTea, a sophisticated remote access trojan (RAT) that has served as Lazarus’s payload of choice for three years.

BinMergeLoader leverages the Microsoft Graph API and uses Microsoft API tokens for authentication.

First observed in October 2022, ScoringMathTea supports approximately 40 commands, enabling attackers to manipulate files and processes, collect system information, establish TCP connections, and execute downloaded payloads.

One dropper sample discovered by researchers contained the internal name “DroneEXEHijackingLoader.dll,” providing a direct link to the campaign’s focus on UAV technology theft.

The malware leverages DLL side-loading techniques and trojanizes legitimate open-source projects from GitHub including TightVNC Viewer, MuPDF reader, and plugins for Notepad++ and WinMerge to evade detection.

ESET researchers noted significant evolution in the group’s tactics, including new DLL proxying libraries and improved selection of open-source projects for trojanization.

The malware uses compromised WordPress servers for command-and-control communication, typically storing server components within theme or plugin directories.

The timing and target selection strongly suggest the campaign aims to steal proprietary UAV designs, manufacturing processes, and industrial know-how.

North Korea has invested heavily in domestic drone capabilities, with recent reports indicating Pyongyang is developing low-cost attack UAVs for potential export to African and Middle Eastern markets. Russia is reportedly assisting North Korea in producing knockoff Iranian Shahed suicide drones.

North Korea’s flagship reconnaissance drone, the Saetbyol-4, appears as a carbon copy of the Northrop Grumman RQ-4 Global Hawk, while the Saetbyol-9 combat drone closely resembles General Atomics’ MQ-9 Reaper.

These designs demonstrate North Korea’s reliance on reverse engineering and intellectual property theft to advance its military capabilities.

At least one targeted company manufactures critical components for UAV models currently deployed in Ukraine, which North Korean forces may have encountered on the frontline in Russia’s Kursk region, where North Korean troops were deployed in 2025.

Additionally, the company is involved in advanced single-rotor drone development unmanned helicopter technology that Pyongyang is actively developing but has not successfully militarized.

Attribution and Broader Context

ESET attributed the attacks to Lazarus with high confidence based on multiple indicators: the social engineering methodology, trojanization of GitHub open-source projects for DLL side-loading, deployment of ScoringMathTea, and targeting of European aerospace and defense sectors.

Lazarus, also known as HIDDEN COBRA, is an advanced persistent threat (APT) group linked to North Korean intelligence services and active since at least 2009.

The group is responsible for high-profile incidents including the 2016 Sony Pictures Entertainment hack, tens-of-millions-of-dollar cyberheists, the 2017 WannaCry ransomware outbreak, and ongoing attacks against South Korean infrastructure.

Security experts recommend defense contractors implement rigorous employee training on social engineering tactics, particularly fake recruitment lures.

Organizations should scrutinize job offers from unexpected sources, verify executable files before opening, and deploy advanced endpoint detection solutions capable of identifying trojanized legitimate software.

Network segmentation and privileged access management can limit lateral movement if initial compromise occurs.

IoCs

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.