ESET: Lazarus renews drone targeting; DeceptiveDevelopment hits repositories
Original title: North Korean Hackers Target Drone Technology and Software Supply Chains in New Cyberespionage Campaigns
The October 28 report covers April to September 2026 and says the two North Korea-aligned operations are distinct, not one coordinated campaign.
ESET’s APT Activity Report says Lazarus again used recruitment-themed lures against drone-technology organizations, which researchers link to interest in unmanned systems used in Ukraine. The report does not publish equivalent technical detail for each 2026 intrusion and does not claim confirmed theft of specific designs. Separately, DeceptiveDevelopment harvested developer credentials and injected malicious code into public and private repositories. ESET says overlapping interest in Ukraine does not show Russian direction.
Unconfirmed: Information sought in individual intrusions is uncertain, 2026 Lazarus tooling is not fully detailed, and Russian direction is not shown.
- Earlier DreamJob cases hit three European defense companies, at least two on UAV work.
- Historical payloads included ScoringMathTea and BinMergeLoader via Microsoft Graph.
- DeceptiveDevelopment previously used BeaverTail and InvisibleFerret against developers.
- The write-up also says Gamaredon deployed Turla script Rezzuar via PteroPSDoor.
Impact: access to drone engineering environments and repository code
- Threat actors
- LazarusDeceptiveDevelopmentGamaredonTurla
- Organizations
- ESET
- Countries
- North KoreaUkraine
From the original article
3 min read at gbhackers.com
North Korea-aligned hackers have renewed attacks on drone technology companies while expanding operations against software supply chains. Together, these campaigns expose industrial knowledge and software distribution channels to compromise. ESET’s APT Activity Report, published October 28, covers operations observed between April and September 2026.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.