Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
ESET reported in October 2025 that a North Korea-aligned Lazarus operation successively targeted three defense-sector companies in Central and Southeastern Europe. Some of the companies were heavily involved in unmanned aerial vehicles (UAVs). ESET assessed with high confidence that the activity was part of Operation DreamJob and may have sought proprietary information and manufacturing know-how, including knowledge related to drones. The publicly reviewed release did not name the companies and did not establish that a specific design or dataset was successfully stolen.
What happened in the European drone-maker campaign?
ESET said the attacks successively targeted three defense companies in Central and Southeastern Europe. The companies made military equipment, including equipment deployed in Ukraine, and some worked extensively on UAVs. ESET did not identify the businesses, so it is not accurate to describe the incident as an attack on three named drone manufacturers.
The report describes a suspected espionage operation rather than a publicly documented breach with a complete inventory of stolen files. ESET’s assessment was that the likely primary objective was exfiltration of proprietary information and manufacturing know-how. UAV-related knowledge was considered a likely area of interest.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWho was behind it?
ESET attributed the activity to Lazarus with high confidence and grouped it within Operation DreamJob. That attribution is ESET’s analytic judgment, not a public claim of responsibility by the operator or an independently established identification of every person involved.
#1 Best Overall
- 1. Unique DIY Drone:This DIY drone integrates optical flow positioning modules, video modules, and high-power brushless motors.The assembly process takes approximately 1.5 hours and requires patience and hands-on skills. Recommended for users aged 14 and above. Difficulty level: 5/5.
- 2. A Project Worth Showcasing:Packed with extensive foundational knowledge about drones, this kit allows you to deeply understand drone technology during assembly. Master the principles and confidently showcase your expertise, gaining admiration from friends.
- 3. Multifunctional Flight Experience:360° flips,One-click takeoff/landing,Headless mode,Speed adjustment,Optical flow positioning,Real-time video transmission,Perfect for indoor/outdoor flight performances,Operation difficulty : 5/5(practice required for proficiency).
- 4. Worry-Free Flying:Includes spare propellers for quick post-crash replacements.Flight time can be up to 30 minutes.【about LED】Slight flight control algorithm differences across batches. If LEDs won't light up, switch to the other installation mode. No impact on flight.
- 5. Educational Value:The detailed manual explains drone fundamentals and serves as a reference for STEM project plans or curriculum design. Includes editable PowerPoint teaching materials to support educators.
ESET based its assessment on several overlapping indicators:
- The use of social-engineering methods associated with earlier Operation DreamJob activity.
- Targeting of defense organizations in a geography and sector consistent with earlier Lazarus operations.
- The ScoringMathTea remote-access trojan (RAT), which ESET linked to the campaign.
ESET researcher Peter Kálnai said, “We believe that it is likely that Operation DreamJob was — at least partially — aimed at stealing proprietary information, and manufacturing know-how, regarding UAVs. The drone mention observed in one of the droppers significantly reinforces this hypothesis.” The conditional language matters: it describes an assessed objective, not confirmed theft.
How did Lazarus target the companies?
Fake employment offers
Operation DreamJob commonly begins with a lucrative but fraudulent job approach. A target receives a role description or recruiting message and is encouraged to open documents or run software as part of a supposed application process. ESET said initial access in the reported activity was almost certainly achieved through social engineering.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #2
- 𝐘𝐨𝐮𝐫 𝟏𝐬𝐭 𝐃𝐈𝐘 𝐃𝐫𝐨𝐧𝐞 - F450 is the best DIY drone for both beginners to learn the basics and experts to conduct research or secondary development.
- 𝐌𝐨𝐫𝐞 𝐂𝐚𝐩𝐚𝐜𝐢𝐭𝐲 & 𝐌𝐨𝐫𝐞 𝐒𝐩𝐚𝐜𝐞 - Wheelbase: 450mm, Maximum take-off weight: approx. 1.8 kg. It has enough space for flight control, Raspberry Pi, camera, sensors, etc.
- 𝐍𝐞𝐰𝐛𝐢𝐞 𝐅𝐫𝐢𝐞𝐧𝐝𝐥𝐲 - We have prepared a quick start guide for new players that will assist you with the assembly and calibration of a DIY drone. Please contact us if you need it.
- 𝐁𝐫𝐚𝐧𝐝 𝐏𝐚𝐫𝐭𝐬 - We use parts from brands for stable and reliable quality. Free replacement for quality problems within 3 months.
- 𝐅𝐥𝐢𝐠𝐡𝐭 𝐂𝐨𝐧𝐭𝐫𝐨𝐥 𝐍𝐎𝐓 𝐈𝐧𝐜𝐥𝐮𝐝𝐞𝐝 – Assembling a complete drone requires flight controls, which are not included in this kit. You can choose the flight control according to your needs and budget.
Trojanized documents and open-source code
DreamJob lures have used a fake or trojanized PDF reader as a decoy. In the 2025 activity, ESET also observed malicious loading routines inserted into open-source projects available on GitHub. A project that appears useful to a developer or engineer can therefore become the delivery mechanism when it is downloaded, built or executed.
ScoringMathTea payload
ESET identified ScoringMathTea as the main payload. It is a RAT capable of giving an operator control over a compromised computer. ESET described roughly 40 commands, including:
- File and process manipulation.
- Collection of system information.
- Network connections.
- Command execution and delivery of additional payloads.
The “around 40 commands” figure comes from ESET’s report. It is not an independent performance measurement, and the presence of the payload in reporting does not prove that every targeted company was successfully compromised.
Rank #3
- Unique DIY Drone: This DIY drone integrates advanced optical flow positioning modules, video modules, and high-power brushless motors. You need to complete everything from every single screw to the overall assembly, and the assembly takes approximately 1.5 hours. It is recommended for users over 14 years old. Difficulty level: 5 stars (out of 5 stars).
- An Impressive Project to Show Off: This project is packed with extensive basic knowledge of drones. It enables you to acquire more profound knowledge about drones during the assembly process, allowing you to boast more confidently and draw more admiration from others.
- Multi-functional Flight Experience: It offers five amazing flight functions: 360° roll, one-click takeoff and landing, headless mode, speed adjustment, optical flow positioning, and real-time video viewing, adding infinite fun to your flight experience and allowing you to perform flight shows easily in the office or at home. Operation Difficulty: 5 stars (Proficiency in flight requires practice).
- Worry-free Flight: Spare propellers are included to ensure that you can quickly replace them even if you encounter an accident during flight and continue to enjoy the fun of flying. The single flight duration can reach 30 minutes.
- Educational Significance: The detailed instruction manual not only introduces the basic principles of drones but is also very suitable as reference material for STEM project plans or curriculum design. In addition, we provide easily modifiable PPT courseware to assist your educational work.【about LED】Slight flight control algorithm differences across batches.If LEDs won't light up, switch to the other installation mode.No impact on flight.
What information were the attackers seeking?
ESET assessed that the suspected goal was theft of proprietary information and manufacturing know-how. That could include engineering knowledge, production methods or other business information, but the public account does not provide a confirmed list of stolen files or prove that a complete UAV design was exfiltrated.
ESET said one targeted entity was involved in producing at least two UAV models used in Ukraine and in the supply chain for advanced single-rotor drones. Alexis Rapin, an ESET cyberthreat analyst, said North Korea may have encountered those systems on the front line and that Pyongyang was actively developing a similar aircraft type. This is contextual analysis about possible interest and motive, not proof that the campaign was ordered for that specific reason.
Were the companies named?
No. The ESET release reviewed for this account does not identify the three companies. Hints about Central or Southeastern Europe, equipment used in Ukraine, or particular UAV types are not enough to identify them reliably. Naming a company without an official disclosure would risk turning inference into fact.
Rank #4
- 5 in 1 DIY Drone Build Kit: This 5 in 1 DIY Drone Build Kit is an exciting and educational toy that provides kids with a fun and engaging way to learn about drones and STEM concepts. With 159 easy-build pieces, kids can build their own drones in different styles and colors, improving their imagination and creativity, get start in RC drone!
- Easy Control for Kids & Beginners: The drone comes with several features that make it easy to fly for kids and beginners, such as Altitude Hold, Headless Mode, One Key Take-off/Land, Low Power Warning, and Emergency Stop functions. keep the drone hovers at a certain height, you can the control the fly direction at will.
- Fun to Play: Equipped with 3D flip and 3 Speed Modes, Kids can also perform 3D flip stunts in four directions and control the drone's speed in three different modes. playable with all skill levels and all ages.
- Great Gift for Boys&Girls: The pieces of the drone kit are sturdy, durable, and made of premium quality and non-toxic ABS plastic. The drone is equipped with four propeller guards that protect kids from spinning propellers and the drone from damage.
- Quality and non-toxic ABS plastic. Equipped with 4 sides propellers guards which protects kids from spinning propellers and protects drone from damage. It is no doubt a Great gift for birthday, Children's Day, Christmas, kids will love the building and get the drone to fly!
Timeline and related reporting
| Report | What it describes | How to interpret it |
|---|---|---|
| ESET, October 2025 | Three defense-sector targets in Central and Southeastern Europe; social engineering, malicious GitHub projects and ScoringMathTea; suspected interest in proprietary and UAV manufacturing knowledge. | The campaign covered by this article. ESET attributed it to Lazarus with high confidence. |
| Check Point Research, 11 August 2026 | A later Operation Dream Job wave against defense organizations in Europe and India, including a trojanized PDF viewer and exploitation of CVE-2026-68820. Check Point said Microsoft released a patch on 11 August 2026. | Later context, not an account of the 2025 ESET incidents. Its targets and techniques should not be merged with them. |
ESET also traced earlier ScoringMathTea samples to submissions from Portugal and Germany in October 2022 and reported later observations in India, Poland, the United Kingdom and Italy. Those telemetry observations span earlier cases and should not be treated as a list of victims in this European campaign.
What the campaign means for defense and engineering organizations
The reported method targets trust and routine developer behavior as much as technical vulnerabilities. Organizations working on UAVs or other defense technologies should treat unsolicited recruiting, project downloads and requests to install “interview” tools as security events.
Reduce social-engineering exposure
- Verify recruiters and job offers through a separate, known channel before opening attachments or running interview software.
- Train staff to report unusual recruiting messages, especially those asking for code execution or access to internal systems.
- Separate personal job-search activity from corporate devices and accounts.
Control software execution
- Allow software and development dependencies from approved sources and pin or review open-source components.
- Use application controls and least privilege so a downloaded project cannot freely execute or alter system files.
- Keep PDF readers, operating systems and development tools patched, while recognizing that patching alone does not stop a malicious legitimate-looking project.
Detect and contain endpoint activity
- Monitor for unexpected child processes, outbound connections, persistence and command execution from document readers or developer tools.
- Collect endpoint and network telemetry centrally so investigators can identify lateral movement and attempted data collection.
- Prepare isolation, credential-reset and forensic procedures before an alert occurs.
Endpoint detection and response or managed detection and response services may help organizations implement these controls, but the campaign reports do not establish that any particular product would have prevented the activity.
Bottom line
ESET’s October 2025 disclosure describes a suspected Lazarus espionage campaign against three unnamed defense companies in Central and Southeastern Europe, including firms involved in UAVs. The operation used Operation DreamJob-style social engineering and the ScoringMathTea RAT. ESET assessed that proprietary and manufacturing information may have been the objective, but public evidence does not confirm a specific theft or identify the companies. Later reporting from 2026 concerns a separate wave and should be kept distinct.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
