North Korean Hackers Attacking Unmanned Aerial Vehicle Industry to Steal Confidential Data

**Operation DreamJob (Lazarus):** North Korean state-sponsored Lazarus actors targeted Central and Southeastern European UAV developers beginning March 2025, using fraudulent job offers to deliver trojanized PDF readers and trojanized open-source tools (TightVNC, MuPDF, WinMerge plugins, Notepad++ plugins). The attackers deployed multi-stage droppers (including DroneEXEHijackingLoader.dll and BinMergeLoader) and the ScoringMathTea RAT to achieve file/process control and exfiltration, relied on DLL side-loading and reflective in-memory injection, employed AES-128/ChaCha20 and IDEA+base64 for layered encryption, and used compromised WordPress-hosted servers and domains such as coralsunmarine.com, mnmathleague.org, and spaincaramoon.com for C2 and payload delivery.