Lazarus and DeceptiveDevelopment target drones and software supply chains
Original title: North Korean Hackers Target Drone Technology and Software Supply Chains in New Cyberespionage Campaigns
ESET says April–September 2026 activity used fake job offers, then spread malware through stolen developer accounts and public packages.
ESET's APT Activity Report says Lazarus resumed Operation DreamJob against European defense and unmanned-aircraft suppliers around June 2026. One Central European defense employee received a password-protected ZIP with a trojanized SumatraPDF viewer and MortPusLoader Notepad++ plugins. DeceptiveDevelopment stole Git credentials, SSH keys and tokens, then injected code into npm, Go, Packagist, PyPI and extension repositories. Compromised Roundcube servers and an Ethereum-wallet lookup supported command and control.
Unconfirmed: ESET says the Ukraine-war link is an assessment, and the exact data sought in each intrusion is uncertain.
- Operation DreamJob resumed around June 2026 after activity documented in October 2025.
- Payloads included ScoringMathTea, LightlessTeaR, OmniStealer and updated DEV#POPPER RAT.
- NullReceiver reads a hardcoded Ethereum wallet transaction to obtain the server IP.
- ESET listed npm packages bianira-ui@1.27.0 and fluid-type-ui@2.0.8 as loaders.
- Most poisoned projects were small utilities, which ESET reads as automated spread.
Impact: Defense designs, developer secrets, and poisoned downstream packages
- 1.Hunt for bianira-ui@1.27.0, fluid-type-ui@2.0.8, and wallet 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a.
- 2.Review Git, SSH, and token access on accounts used in recruitment tasks.
- 3.Inspect repositories for rewritten history and hidden VS Code tasks.
- ATT&CK
- T1566.001 Spearphishing AttachmentT1195.002 Compromise Software Supply ChainT1552.004 Private KeysT1078 Valid Accounts
- Products
- Notepad++SumatraPDFRoundcube
- Threat actors
- LazarusDeceptiveDevelopment
- Organizations
- ESET
- Countries
- North Korea
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 166.88.134.62 | f6970626f742121 Encodes command-server address C2 endpoints 166.88.134.62:443 , 166.88.134.62:80 Published command infrastructure Cod |
From the original article
3 min read at cybersecuritynews.com
North Korean hackers have renewed efforts to steal drone technology while expanding attacks against software developers and the projects they maintain. Activity tracked between April and September 2026 shows Lazarus returning to European defense targets, while DeceptiveDevelopment used stolen developer credentials to spread malicious code through software supply chains. The campaigns share a familiar starting […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.