North Korean hacking group targeting European drone maker with ScoringMathTea malware

North Korean hacking group Lazarus is targeting European defense companies to steal drone manufacturing secrets using spear-phishing emails with malware. This campaign, part of Operation DreamJob, involves the use of the ScoringMathTea malware and highlights North Korea’s interest in UAV technology for both military and domestic purposes. #LazarusGroup #OperationDreamJob #ScoringMathTea #UAVtheft #NorthKorea

Keypoints

The Lazarus group targeted defense companies across Central and Southeastern Europe with spear-phishing emails.
The emails contained PDFs with malware called ScoringMathTea, which allows remote control and data theft.
The campaign appears linked to North Korea’s military interests in drones used in Ukraine and Russia.
Researchers have tracked the malware back to October 2022, involving attacks on multiple European nations.
The Operation DreamJob campaign has been active since 2020, with authorities noting its focus on stealing aerospace and naval technology.