Lazarus Hackers Actively Attacking European Drone Manufacturing Companies

Lazarus (HIDDEN COBRA) has conducted Operation DreamJob since March 2025, targeting Central and Southeastern European drone manufacturers and defense contractors with social-engineered fake job offers that deliver trojanized applications (e.g., TightVNC, MuPDF, WinMerge plugins) and a sophisticated RAT called ScoringMathTea; attackers use DLL side-loading and in-memory-only encryption to evade detection and steal UAV design IP and components data.