ESET Research says North Korea-linked Lazarus targeted three defense-sector companies in Central and Southeastern Europe in a new Operation DreamJob campaign; some of the firms were heavily involved in unmanned aerial vehicles (UAVs), or drones. ESET assessed that the attackers likely sought proprietary information and manufacturing know-how, but the reporting does not confirm that any data was stolen or identify the companies.
What happened in the reported campaign?
In an announcement published October 23, 2025, ESET described attacks on three defense-sector companies in Central and Southeastern Europe. ESET did not name them. CyberScoop reported that the targets were a metal engineering company, an aircraft component manufacturer, and a defense company, and placed the attacks in late March 2025. That timing and the company descriptions come from CyberScoop, not from a specific attack date or named targets in ESET’s announcement.
ESET characterized this activity as a new wave of Operation DreamJob, a campaign pattern in which attackers use a lucrative but fake job offer to draw a target into opening a decoy job-description document and a trojanized PDF reader. ESET assessed that social engineering was almost certainly how the attackers initially gained access in this case. The principal payload it reported was ScoringMathTea, a remote-access trojan (RAT) that gives attackers control over an infected computer.
Why might Lazarus have targeted drone-related firms?
ESET assessed that the likely primary objective was to exfiltrate proprietary information and manufacturing know-how. It said the targeting of companies involved in UAVs may align with reported developments in North Korea’s drone program. CyberScoop reported ESET’s view that information about materials manufacturing and drone development could be valuable. These are assessments of possible motive, not confirmation of intent or successful theft.
#1 Best Overall
- 𝐘𝐨𝐮𝐫 𝟏𝐬𝐭 𝐃𝐈𝐘 𝐃𝐫𝐨𝐧𝐞 - F450 is the best DIY drone for both beginners to learn the basics and experts to conduct research or secondary development.
- 𝐌𝐨𝐫𝐞 𝐂𝐚𝐩𝐚𝐜𝐢𝐭𝐲 & 𝐌𝐨𝐫𝐞 𝐒𝐩𝐚𝐜𝐞 - Wheelbase: 450mm, Maximum take-off weight: approx. 1.8 kg. It has enough space for flight control, Raspberry Pi, camera, sensors, etc.
- 𝐍𝐞𝐰𝐛𝐢𝐞 𝐅𝐫𝐢𝐞𝐧𝐝𝐥𝐲 - We have prepared a quick start guide for new players that will assist you with the assembly and calibration of a DIY drone. Please contact us if you need it.
- 𝐁𝐫𝐚𝐧𝐝 𝐏𝐚𝐫𝐭𝐬 - We use parts from brands for stable and reliable quality. Free replacement for quality problems within 3 months.
- 𝐅𝐥𝐢𝐠𝐡𝐭 𝐂𝐨𝐧𝐭𝐫𝐨𝐥 𝐍𝐎𝐓 𝐈𝐧𝐜𝐥𝐮𝐝𝐞𝐝 – Assembling a complete drone requires flight controls, which are not included in this kit. You can choose the flight control according to your needs and budget.
The available reporting does not establish that attackers obtained drone blueprints, other specific technical data, or information that advanced a particular North Korean weapons program. It also does not establish the extent of access, whether all three companies were compromised, or what—if anything—left their networks. Neither source gives a campaign-specific figure for stolen data, financial loss, or confirmed impact.
How did ESET link the activity to Lazarus?
ESET attributed the campaign to Lazarus with high confidence and linked it to Operation DreamJob. Its rationale included the fake-recruiting approach, trojanized open-source projects from GitHub, the ScoringMathTea payload, and overlap in sector and geography with earlier DreamJob activity. ESET also noted prior ScoringMathTea observations against an India-based technology company in January 2023, a Polish defense company in March 2023, a British industrial automation company in October 2023, and an Italian aerospace company in September 2025. Those are separate dated observations, not additional victims counted in this three-company campaign.
Rank #2
- 1. Unique DIY Drone:This DIY drone integrates optical flow positioning modules, video modules, and high-power brushless motors.The assembly process takes approximately 1.5 hours and requires patience and hands-on skills. Recommended for users aged 14 and above. Difficulty level: 5/5.
- 2. A Project Worth Showcasing:Packed with extensive foundational knowledge about drones, this kit allows you to deeply understand drone technology during assembly. Master the principles and confidently showcase your expertise, gaining admiration from friends.
- 3. Multifunctional Flight Experience:360° flips,One-click takeoff/landing,Headless mode,Speed adjustment,Optical flow positioning,Real-time video transmission,Perfect for indoor/outdoor flight performances,Operation difficulty : 5/5(practice required for proficiency).
- 4. Worry-Free Flying:Includes spare propellers for quick post-crash replacements.Flight time can be up to 30 minutes.【about LED】Slight flight control algorithm differences across batches. If LEDs won't light up, switch to the other installation mode. No impact on flight.
- 5. Educational Value:The detailed manual explains drone fundamentals and serves as a reference for STEM project plans or curriculum design. Includes editable PowerPoint teaching materials to support educators.
The U.S. Treasury identifies Lazarus as a North Korean state-sponsored group linked to the Reconnaissance General Bureau. MITRE ATT&CK cautions that “Lazarus Group” can be used publicly as an umbrella label: shared personnel, infrastructure, malware, and techniques can make attribution difficult. That context does not negate ESET’s assessment, but it helps explain why a group name is an attribution rather than a direct identification of individual operators.
What is confirmed—and what remains unknown?
| Question | What the reporting says |
|---|---|
| Who was targeted? | Three defense-sector companies in Central and Southeastern Europe; some had substantial UAV involvement. The companies’ names are not disclosed. (ESET Research; CyberScoop) |
| When did the attacks happen? | CyberScoop reported late March 2025. ESET’s October 23, 2025 announcement does not specify an exact attack date. |
| How did the attackers approach targets? | ESET described a fake job offer, decoy job-description document, and trojanized PDF reader as the Operation DreamJob pattern, and assessed social engineering as the almost-certain initial access method. |
| What payload was reported? | ScoringMathTea, a RAT that ESET says gives attackers control of the compromised machine. |
| Was information stolen? | Not established in ESET’s announcement or CyberScoop’s reporting; the suspected goal was theft of proprietary information and manufacturing know-how. |
What organizations can take from the incident
The reported approach makes recruiting communications and downloaded software relevant points for defense firms to examine. The incident sources do not test or rank particular security products, but organizations can review whether their procedures address:
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Quick Recap
Rank #4
- 𝐘𝐨𝐮𝐫 𝟏𝐬𝐭 𝐃𝐈𝐘 𝐃𝐫𝐨𝐧𝐞 - F450 is the best DIY quadcopter drone for both beginners to learn the basics and experts to conduct research or secondary development.
- 𝐌𝐨𝐫𝐞 𝐂𝐚𝐩𝐚𝐜𝐢𝐭𝐲 & 𝐌𝐨𝐫𝐞 𝐒𝐩𝐚𝐜𝐞 - Wheelbase: 450mm, Maximum take-off weight: approx. 1.8 kg. It has enough space to connect flight control, Raspberry Pi, camera, sensors, etc.
- 𝐏𝐢𝐱𝐡𝐚𝐰𝐤 𝐈𝐧𝐜𝐥𝐮𝐝𝐞𝐝 - It can be used as a master controller for fixed-wing, multi-rotor, helicopter, boat, car, etc. By connecting relevant components, it allows for automated driving and customization.
- 𝐍𝐞𝐰𝐛𝐢𝐞 𝐅𝐫𝐢𝐞𝐧𝐝𝐥𝐲 - We have prepared a quick start guide for new players that will assist you with the assembly and calibration of a DIY drone. Please contact us if you need it.
- 𝐁𝐫𝐚𝐧𝐝𝐞𝐝 𝐏𝐚𝐫𝐭𝐬 - We use parts from brands for stable and reliable quality. Free replacement for quality problems within 3 months.
Rank #3
- Unique DIY Drone: This DIY drone integrates advanced optical flow positioning modules, video modules, and high-power brushless motors. You need to complete everything from every single screw to the overall assembly, and the assembly takes approximately 1.5 hours. It is recommended for users over 14 years old. Difficulty level: 5 stars (out of 5 stars).
- An Impressive Project to Show Off: This project is packed with extensive basic knowledge of drones. It enables you to acquire more profound knowledge about drones during the assembly process, allowing you to boast more confidently and draw more admiration from others.
- Multi-functional Flight Experience: It offers five amazing flight functions: 360° roll, one-click takeoff and landing, headless mode, speed adjustment, optical flow positioning, and real-time video viewing, adding infinite fun to your flight experience and allowing you to perform flight shows easily in the office or at home. Operation Difficulty: 5 stars (Proficiency in flight requires practice).
- Worry-free Flight: Spare propellers are included to ensure that you can quickly replace them even if you encounter an accident during flight and continue to enjoy the fun of flying. The single flight duration can reach 30 minutes.
- Educational Significance: The detailed instruction manual not only introduces the basic principles of drones but is also very suitable as reference material for STEM project plans or curriculum design. In addition, we provide easily modifiable PPT courseware to assist your educational work.【about LED】Slight flight control algorithm differences across batches.If LEDs won't light up, switch to the other installation mode.No impact on flight.
- Recruiting and employee verification: Give staff a way to verify unsolicited job-related messages and attachments through a separate, known contact channel.
- Downloaded applications: Restrict or scrutinize software obtained from links in recruiting messages, including purported PDF readers and open-source applications.
- Endpoint monitoring: Look for suspicious execution and remote-control behavior associated with untrusted installers or documents, and define how employees should report unexpected software prompts.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
