ESET: North Korean groups hit drone firms and code supply chains

ESET says two distinct North Korea-aligned operations in 2026 targeted drone suppliers and developer repositories, without confirmed design theft.

ESET’s APT Activity Report, dated October 28 and covering April to September 2026, describes two distinct North Korea-aligned operations rather than one coordinated campaign. Lazarus resumed Operation DreamJob around June 2026 against European defense and unmanned-aircraft suppliers using recruitment lures; researchers link the targeting to interest in systems used in Ukraine, but ESET does not claim confirmed theft of specific designs. One Central European defense employee received a password-protected ZIP with a trojanized SumatraPDF viewer and MortPusLoader Notepad++ plugins. Separately, DeceptiveDevelopment stole Git credentials, SSH keys and tokens and injected code into npm, Go, Packagist, PyPI and extension repositories. ESET says overlapping interest in Ukraine does not show Russian direction.