EN PT-BR
← Voltar ao feed
high defense drone_technology software_development

North Korea-aligned Lazarus and DeceptiveDevelopment renew drone-sector lures and developer repository attacks

1 fonte(s) · 1 atualização(ões) · publicado 10/11/2026 07:51 · coletado há 1 hora

Lazarus, the North Korea-aligned cluster, has resumed targeting drone-sector organizations, mostly through recruitment-themed lures, according to ESET's APT Activity Report for Q2–Q3 2026 (welivesecurity.com). In the same period DeceptiveDevelopment moved from fake job interviews to software supply-chain intrusions, harvesting developer credentials and injecting code into public and private repositories (welivesecurity.com). The two groups run separate operations, and the drone-focused collection goal is an assessment rather than a confirmed theft of designs. The lure-based approach builds on ESET's October 2025 research into Operation DreamJob, which hit three defense companies in Central and Southeastern Europe with trojanized open-source software. No vulnerability or CVE is involved, so no patch applies and the risk is targeted espionage with supply-chain reach, which is why the rating is high rather than critical.

Detalhes técnicos

  • The 2025 DreamJob chain used job descriptions paired with modified open-source applications (MuPDF, TightVNC and developer-tool plugins) that carried malicious loading routines; the principal payload, ScoringMathTea, provided remote control, and BinMergeLoader fetched further payloads through Microsoft Graph API infrastructure.
  • Execution happens on the victim's workstation after the target chooses to run the lure, so the intrusion depends on social engineering rather than a disclosed flaw.
  • DeceptiveDevelopment harvests developer credentials and uses them to alter repositories, which turns one compromised account into a route to code trusted by colleagues and customers. Its earlier tooling, BeaverTail and InvisibleFerret, targeted Windows, Linux and macOS developers and aimed at browser credentials, password-manager data and cryptocurrency assets.
  • ESET names Ukraine as a growing focus and considers the war's drone use the likely motivation, while noting that overlapping interest with Russia does not show North Korean operations are directed by Moscow (welivesecurity.com).

Relatos divergentes

  • The article places a Gamaredon paragraph (PteroPSDoor, and a Turla reconnaissance VBScript called Rezzuar) inside its North Korea drone story. ESET's public report (welivesecurity.com) files these under its Russia-aligned activity, so they are not attributed to North Korea here.
  • The article dates these Gamaredon cases to March, April and June 2026. The ESET summary I opened does not give those dates, so they remain unconfirmed.

Linha do tempo

  1. gbhackers.com ↗ · pub. 10/11/2026 07:51 · coletado 10/11 08:00 primeiro registro

    North Korea-aligned Lazarus and DeceptiveDevelopment renew drone-sector lures and developer repository attacks

    ler a análise desta fonte

    Lazarus, the North Korea-aligned cluster, has resumed targeting drone-sector organizations, mostly through recruitment-themed lures, according to ESET's APT Activity Report for Q2–Q3 2026 (welivesecurity.com). In the same period DeceptiveDevelopment moved from fake job interviews to software supply-chain intrusions, harvesting developer credentials and injecting code into public and private repositories (welivesecurity.com). The two groups run separate operations, and the drone-focused collection goal is an assessment rather than a confirmed theft of designs. The lure-based approach builds on ESET's October 2025 research into Operation DreamJob, which hit three defense companies in Central and Southeastern Europe with trojanized open-source software. No vulnerability or CVE is involved, so no patch applies and the risk is targeted espionage with supply-chain reach, which is why the rating is high rather than critical.

    Technical Details

    • The 2025 DreamJob chain used job descriptions paired with modified open-source applications (MuPDF, TightVNC and developer-tool plugins) that carried malicious loading routines; the principal payload, ScoringMathTea, provided remote control, and BinMergeLoader fetched further payloads through Microsoft Graph API infrastructure.
    • Execution happens on the victim's workstation after the target chooses to run the lure, so the intrusion depends on social engineering rather than a disclosed flaw.
    • DeceptiveDevelopment harvests developer credentials and uses them to alter repositories, which turns one compromised account into a route to code trusted by colleagues and customers. Its earlier tooling, BeaverTail and InvisibleFerret, targeted Windows, Linux and macOS developers and aimed at browser credentials, password-manager data and cryptocurrency assets.
    • ESET names Ukraine as a growing focus and considers the war's drone use the likely motivation, while noting that overlapping interest with Russia does not show North Korean operations are directed by Moscow (welivesecurity.com).

    Conflicting Reports

    • The article places a Gamaredon paragraph (PteroPSDoor, and a Turla reconnaissance VBScript called Rezzuar) inside its North Korea drone story. ESET's public report (welivesecurity.com) files these under its Russia-aligned activity, so they are not attributed to North Korea here.
    • The article dates these Gamaredon cases to March, April and June 2026. The ESET summary I opened does not give those dates, so they remain unconfirmed.