North Korean Lazarus hackers targeted European defense companies

ESET reported that the North Korean Lazarus Group ran Operation DreamJob in late March, using fake recruiter lures to target three European defense companies involved in UAV technology; attackers distributed trojanized open-source applications and plugins that loaded malicious DLLs via DLL sideloading, employed in-memory loading routines, and deployed the ScoringMathTea RAT or a loader (BinMergeLoader/MISTPEN) that abuses Microsoft Graph API for additional payloads, with ESET publishing extensive IoCs.