Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
McAfee’s November 2020 follow-up found that Operation North Star’s apparent reach extended beyond South Korea: its analysis associated activity with targets in Australia, India, Israel and Russia. The campaign used tailored job-offer lures aimed at people connected to defense and aerospace, then selectively monitored some infected systems with a second-stage implant. That retrospective finding does not establish that the same infrastructure or campaign is active today.
What changed in McAfee’s November 2020 findings
McAfee’s initial Operation North Star reporting focused on malicious job-posting documents and activity centered on South Korea. In a follow-up published November 5, 2020, the company said analysis of command-and-control (C2) logs and backend infrastructure exposed a broader set of likely targets. CyberScoop summarized the additional geographies as Australia, India, Israel and Russia.
McAfee cited two IP addresses in Israeli internet-service-provider address space, as well as addresses in Australian and Russian ISP space, and defense contractors based in India and Russia. These are indicators McAfee associated with the operation—not a publicly verified list of named victims or proof that every organization in those countries was compromised.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11The distinction matters: the later analysis gave researchers a view into infrastructure and victim selection that was not available from examining the lures and first-stage malware alone. It showed a more geographically expansive and selective effort than the earlier South Korea emphasis suggested, but it did not establish a complete victim count.
#1 Best Overall
How the job-offer lures reached targets
Malicious documents dressed as real openings
McAfee’s July 2020 technical report described spear-phishing documents containing job postings copied from defense contractors. The observed document timeline ran from March 31 to May 18, 2020, while the broader campaign’s latest observed activity extended into mid-June. The documents used template injection: a weaponized Word file fetched an external template that contained macros.
ClearSky’s separate account of Operation Dream Job described a more personal approach: fabricated LinkedIn profiles impersonated recruiters, contacted targets at personal email addresses, and continued conversations by phone or WhatsApp. The messages offered positions connected to prominent defense and aerospace companies, including Boeing, McDonnell Douglas and BAE. Those companies were named as the subjects of the lures; the reporting does not suggest they participated in or endorsed the contacts.
Selection continued after infection
In McAfee’s account, the initial implant collected information about the machine and its user. The operator could use that system data to decide whether a particular victim warranted installation of Torisma, a custom second-stage implant. McAfee described Torisma as a tool for more specialized monitoring of selected, higher-value systems, including monitoring activity and running payloads in response to events. It also said lower-value victims could be watched quietly over time.
Free tools Windows power users keep installed
One-click scans. No signup required.
What the operators appeared to want—and what is not proven
McAfee assessed that the detailed job descriptions and selective deployment of Torisma pointed to an effort to obtain specific intellectual property and confidential information from defense technology providers. Its interpretation was of persistent surveillance and potential exfiltration; the technical reporting does not establish that every infected organization suffered data theft or identify a confirmed theft from a particular company.
Rank #3
ClearSky separately said Dream Job gathered information about companies’ activities and finances, possibly to facilitate theft. That is ClearSky’s assessment, not a finding to merge with McAfee’s narrower explanation of North Star’s suspected collection goals. ClearSky also estimated that the campaign had infected “several dozens of companies and organizations in Israel and globally.” This is its qualified estimate, not a precise independently verified victim count.
Why attribution remained disputed
ClearSky assessed Operation Dream Job as North Korean with “high probability” and called it a Lazarus Group campaign. McAfee was more cautious about attributing North Star. It observed that code in the spear-phishing attachments was almost identical to code used in a 2019 Hidden Cobra campaign, but noted that another group could have copied the tools or techniques. McAfee stated: “McAfee cannot independently attribute Operation North Star to a particular hacking group.”
MITRE ATT&CK’s retrospective campaign record notes overlap among Operation Dream Job, Operation North Star and Operation Interception, and says researchers later used Dream Job as an umbrella term for North Star and Interception. That later naming is a taxonomy for related reporting, not proof that every account describes identical activity.
How the two 2020 investigations differ
| Investigation | Reporting and emphasis | Geography and evidence | Attribution |
|---|---|---|---|
| Operation North Star (McAfee) | Initial technical analysis July 29, 2020; expanded findings November 5, 2020. Focused on malicious documents, malware, C2 infrastructure and victim selection. | Initially emphasized South Korea; the follow-up associated activity with Australia, India, Israel and Russia through C2 and infrastructure analysis. | McAfee said it could not independently attribute North Star to a specific group and allowed that techniques could have been copied. |
| Operation Dream Job (ClearSky) | Reported August 13, 2020. Emphasized recruiter impersonation and continued social-engineering contact. | Described targets approached through LinkedIn, personal email, phone and WhatsApp, with lures invoking defense and aerospace employers. | ClearSky assessed North Korean responsibility with high probability and named Lazarus. |
The two reports illuminate different parts of the activity: McAfee’s technical and infrastructure analysis expanded the apparent footprint, while ClearSky detailed the human-facing recruitment pretext and made the firmer attribution. Their related labels and overlapping techniques should not be mistaken for identical evidentiary records.
Quick Recap
Best Value
Sources
- CyberScoop, November 6, 2020, on McAfee’s expanded findings.
- ClearSky Cyber Security, August 13, 2020, on Operation Dream Job’s social engineering and attribution.
- McAfee Advanced Threat Research, July 29, 2020, on North Star’s initial technical findings.
- McAfee Advanced Threat Research, November 5, 2020, on C2 analysis, Torisma, target selection and attribution limits.
- MITRE ATT&CK Campaign C0022, for retrospective naming and technique context.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
