North Korean Hackers Target Drone Technology and Software Supply Chains in New Cyberespionage Campaigns

North Korean hackers have renewed efforts to steal drone technology while expanding attacks against software developers and the projects they maintain.

Activity tracked between April and September 2026 shows Lazarus returning to European defense targets, while DeceptiveDevelopment used stolen developer credentials to spread malicious code through software supply chains.

The campaigns share a familiar starting point: a convincing job offer that persuades someone to run attacker-controlled software. Their goals then diverge.

Lazarus seeks access to sensitive defense systems and technical knowledge, while DeceptiveDevelopment turns compromised developer accounts into distribution channels, exposing users who never interacted with the original fake recruiter.

ESET researchers identified updated malware across these operations, including MortPusLoader, LightlessTeaR, OmniStealer, and DEV#POPPER RAT.

Their latest APT Activity Report describes changes in delivery, persistence, and command infrastructure. The findings build on earlier European drone industry attacks, but the latest reporting shows renewed targeting and a broader software distribution risk.

North Korean Hackers Target Drone Technology and Software Supply Chains

Operation DreamJob resumed targeting drone technology and related supply chains around June 2026, following a quiet period after activity documented in October 2025.

ESET observed attacks against defense companies, mainly in Europe, including original equipment manufacturers and important suppliers within the unmanned aircraft systems industry.

In one attack against a Central European defense company, an employee received a password-protected ZIP archive containing a BAE Systems-themed job description. The PDF had an incorrect header, and the archive included a trojanized SumatraPDF viewer specifically built to open it. This made the supplied viewer appear necessary for reading the document.

The approach echoes job themed manufacturing attacks, where a document viewer helped deliver malware under a recruitment pretext.

In the latest campaign, Lazarus replaced previously used WinMerge plugins, tracked as BinMergeLoader, with two trojanized Notepad++ plugins collectively named MortPusLoader. Familiar software remained central to making the malicious files look credible.

The main payload was either ScoringMathTea, also called ForestTiger, or LightlessTeaR, a rewritten version of LightlessCan.

LightlessTeaR implements common Windows commands internally instead of launching them through the command line, reducing visible command execution.

Compromised Roundcube Webmail servers belonging to academic and government institutions in South America supported command-and-control communications.

ESET assesses that access to drone designs and manufacturing knowledge could help North Korea develop its own capabilities. Its earlier drone espionage research connected similar targeting with proprietary information theft.

However, the precise information sought in individual intrusions remains uncertain, and the Ukraine war connection is an assessment rather than proof of direct coordination with Russia.

Developer Compromises Expand Into Software Supply Chains

DeceptiveDevelopment widened its reach by stealing Git credentials, SSH keys, and access tokens after developers ran malicious recruitment tasks.

The attackers then used that access to inject code into public and private repositories, often rewriting commit history to hide changes. Earlier fake job interview challenges explain the recruitment setup behind this expanding threat.

Affected artifacts reached npm, the Go module mirror, Packagist, PyPI, and browser extension marketplaces. Most compromised projects were small utilities maintained by individuals.

ESET said this pattern suggested automated propagation rather than carefully selected targeting: each poisoned project could become another entry point for downstream users.

The group also adopted NullReceiver, a blockchain-based method for locating command servers. A loader checks the latest outgoing transaction from a hardcoded Ethereum wallet and extracts the server IP from the recipient address.

As previously covered in blockchain hidden malware servers, operators can change servers through another transaction without updating the malicious package.

ESET also found this lookup mechanism launched through a hidden VS Code task inside a legitimate developer’s compromised repository.

Payloads included OmniStealer, a cross-platform Python tool targeting credentials, wallets, password managers, and developer secrets. Updated DEV#POPPER RAT versions inserted code into VS Code, Cursor, and Discord to execute whenever those applications started.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post North Korean Hackers Target Drone Technology and Software Supply Chains in New Cyberespionage Campaigns appeared first on Cyber Security News.