North Korea’s Lazarus group is apparently shopping for drone technology the old-fashioned way: by hacking European defense contractors. ESET spotted another DreamJob campaign using fake job offers and trojanized open-source apps to drop ScoringMathTea RAT on three European defense companies, some of them deep in the drone business. The RAT is an old acquaintance: Microsoft tracks it as ForestTiger and saw Diamond Sleet deploy it in 2023 on JetBrains TeamCity servers breached through CVE-2023-42793. Nothing says “reverse engineering” like stealing the actual blueprints instead of buying cheap drones on AliExpress.
