iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
ClearSky attributed a fake-recruiting cyber-espionage campaign targeting aerospace, aviation and defense organizations to TA455, an Iran-linked group associated with Charming Kitten. Reported activity dated back to at least September 2023. The operation used recruiter impersonation, job-themed email and a fake hiring site to deliver malware, including SnailResin. Its resemblance to North Korean Lazarus “Dream Job” operations complicates attribution, but does not establish that the groups worked together.
What the “Dream Job” campaign was
In reports published in November 2024, RH-ISAC summarized ClearSky’s findings on a campaign that used employment opportunities as a pretext to reach people in aerospace, aviation and defense. ClearSky assessed that the activity had been underway since at least September 2023. The reporting describes espionage-oriented targeting, not a named victim count or a publicly established tally of compromises. RH-ISAC’s November 13, 2024 summary and SecurityWeek’s November 14, 2024 report both relay ClearSky’s assessment.
RH-ISAC’s summary identifies Israel, the United Arab Emirates, Turkey and India as areas of emphasis, with Albania listed as a possible additional focus. These are reported targeting geographies; they do not mean that every organization or employee in those places was targeted.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteHow the fake job offer delivered malware
The reported approach combined social engineering with staged delivery. Attackers posed as recruiters or used job-platform themes to make contact seem relevant to professionals in the targeted industries. The reporting describes fake LinkedIn recruiter profiles, spear-phishing email, job-related ZIP attachments and a counterfeit recruiting site, careers2find[.]com. The domain is shown defanged here because it was reported as part of the campaign, not as a verified safe destination.
#1 Best Overall
- Experience the legendary F-14 Tomcat through a highly detailed model designed for aviation collectors and hobby enthusiasts. The finished model becomes a striking desktop or showcase centerpiece.
- This 3D puzzle is designed for beginner-level assembly enthusiasts, offering an immersive hands-on building experience that helps cultivate patience, concentration, and mechanical problem-solving skills.
- This product is manufactured using high-quality, environmentally friendly plastic and employs an ultra-fine etching process to ensure durability, structural precision, and realistic aircraft details.
- Encourages understanding of aircraft engineering concepts while improving hand-eye coordination and spatial thinking through engaging mechanical assembly.
- Ideal gift for childs, engineers, collectors, model builders, and puzzle lovers for birthdays, Children’s Day, Christmas, or special hobby occasions.
- Recruiting pretext: A target received a job-related message or was directed toward a purported recruiting opportunity.
- File or site delivery: The lure led to job-themed archives or a fake hiring website that distributed ZIP files containing malicious material, including SnailResin.
- Execution and discovery: SecurityWeek reported that ZIP archives could mix fake job documents with legitimate files and that opening malicious documents triggered system fingerprinting.
- Concealment: The operation used obfuscation, custom code and staged deployment. ClearSky also reported use of Cloudflare, GitHub and Microsoft Azure to obscure command-and-control infrastructure.
Those services are legitimate cloud and web platforms, so their appearance in network traffic alone does not prove compromise. The concern is their reported use as part of this particular delivery and concealment chain.
Who TA455 is—and why it is not simply Lazarus
TA455 is ClearSky’s reported designation for the activity. RH-ISAC describes TA455 as a subgroup of Charming Kitten, also known as APT35, and characterizes the operation as Iran-linked. SecurityWeek also lists Smoke Sandstorm and Bohrium as aliases associated with TA455 and describes Charming Kitten as the likely parent group. These are reported threat-intelligence attributions, not independently proven identities.
Rank #2
- HOBBY MODEL KIT – Unassembled model packed in an envelope with easy to follow instructions. Ideal for ages 14 and up
- NO GLUE OR SOLDER NEEDED – Parts can be easily clipped from the metal sheets. Tweezers are the recommended tool for bending and twisting the connection tabs
- F-117 NIGHTHAWK – 2 Sheet Model with a moderate difficulty level. Assembled Size: 4.92 L x 3.35 W x 2.36 H inches
- FROM STEEL SHEETS TO 3D – Pop out the pieces and connect using tabs and holes. Includes illustrated instructions
- HIGHLY DETAILED ETCHED MODEL – Display your 3D model once completed - collect and build them all
The “Dream Job” name can be confusing because North Korean Lazarus operations have also used fake job offers. ClearSky noted similarities including recruiting lures, DLL side-loading and overlapping malware files. Some antivirus engines reportedly classified samples as Kimsuky or Lazarus rather than Charming Kitten. ClearSky discussed two possibilities: Charming Kitten could have been impersonating Lazarus to obscure its activity, or it could have had access to Lazarus methods and tools. Neither resemblance nor those hypotheses confirm joint operations or a shared actor.
The campaign label has also appeared in later reporting. A 2026 Check Point report describes a separate Lazarus fake-job wave involving different malware and the Windows vulnerability CVE-2026-68820. That later activity should not be retroactively attributed to TA455; the shared recruiting theme is not proof that it is the same campaign. Check Point’s 2026 report concerns that separate operation.
What SnailResin and the reported indicators tell defenders
SnailResin was among the malware reported in files distributed through the fake recruiting operation. The campaign reports also describe frequently changing malware and infrastructure, including domains, IP addresses and file hashes. RH-ISAC relays indicators that ClearSky marked “normal confidence” and notes that other indicators appear on pages 14–15 of ClearSky’s original report.
Rank #3
- 2026 Upgraded Edition – Built to Impress at First Sight：Completely upgraded packaging and finishing elevate this jet engine model into a true premium collectible. Designed for those who demand more than just a basic engine model kit.
- Next-Gen 3D Printing – Extreme Mechanical Detail：Produced with advanced 3D printing technology, delivering sharper blades, cleaner structures, and unmatched precision in every turbofan engine model component.
- Realistic Turbofan Structure – Aerospace Engineering in Your Hand：This airplane engine model replicates real turbofan architecture, including fan, compressor, and turbine sections—built for true engineering appreciation.
- Working Engine Experience – Smooth, Satisfying Motion：Upgraded internal mechanism provides a smoother and more refined motion, making this a true working mini jet engine model that stands out from static kits.
- Desk Display Masterpiece – Where Engineering Meets Art：A perfect fusion of mechanical design and modern aesthetics. This engine model for adults transforms any desk into a high-end aerospace workspace.
The available reporting does not establish that those indicators remain active today. Treat the domain and any other campaign indicators as historical observations from 2024, useful for retrospective hunting or enrichment—not as a current blocklist or a reliable stand-alone detection. Do not visit a reported lure domain to test it. Security teams should obtain the original indicator details from the linked reporting and validate them against current telemetry and threat intelligence before using them operationally.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How aerospace employees and security teams can respond
For employees considering an unsolicited opportunity
- Verify the recruiter and vacancy through a company’s independently located careers page or a known corporate contact channel. A profile linked from the suspicious recruiting site is not independent verification.
- Treat unexpected job-related ZIP files and documents as untrusted, even when the sender uses familiar industry language or includes apparently legitimate files alongside them.
- Do not enable macros, bypass endpoint warnings or run supplied files to view a job description. If the approach may be genuine, ask the purported employer to provide the information through a verified channel.
- Report suspicious messages and files through your organization’s security process; avoid forwarding an attachment in a way that could expose another person to it.
For security teams
- Review controls across the whole chain: recruiter and sender verification, email and archive screening, endpoint behavior monitoring, and investigation of suspicious execution or outbound connections.
- Account for staged payloads and obfuscation. A benign-looking document or archive contents may not tell the whole story if opening a file triggers system discovery or another stage.
- Investigate unusual processes and connections in context. Because the reporting describes abuse of legitimate cloud services, blocking an entire provider may be overly broad; correlate the destination with the initiating process, user activity and other indicators.
- Use the reported domains, addresses and hashes as dated leads. Their presence can support an investigation, but their absence does not rule out activity given the reported infrastructure and malware changes.
The November 2024 campaign reports do not provide a tested product comparison or demonstrate that any one defensive control stops TA455. The checks above map to the reported recruiting, file-delivery and concealment stages; they are practical precautions, not a campaign-specific efficacy claim.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallQuick Recap
Best Value
- Airplanes UFOs Space Shuttles Spaceships
Rank #4
- Revell Model Kit #85-5810, Skill Level 4, Contains 66-Parts, Recommended for ages 12 and up
- Accurate surface details
- Includes GTD-21 surveillance drone with cart
- Decals with authentic U.S. Air Force markings
- Molded in black and clear. Paint and glue required(not included).
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
