A new cyberespionage campaign from the Lazarus Group, dubbed Operation DreamJob, is targeting European UAV and defense companies to steal proprietary data.

Lazarus Group's CookiePlus malware targets nuclear engineers, showcasing DPRK's evolving arsenal and $1.34B in 2024 crypto thefts.

Check Point Research tracked a long-running Operation Dream Job campaign linked to Lazarus, with a latest wave targeting defense organizations in Europe and India using trojanized PDF viewers, spear-phishing, and compromised web infrastructure. The campaign deployed SecurityPDF, Troy, MISTPEN, RelayShell, and a new FudModule variant exploiting CVE-2026-68820 while also abusing Roundcube servers via CVE-2025-49113. #OperationDreamJob #Lazarus #SecurityPDF #Troy #MISTPEN #RelayShell #FudModule #CVE-2026-68820 #CVE-2025-49113

What happened at a glance Actor or group Lazarus (DPRK-linked), per Check Point Research Activity type Spear-phishing, trojanized software, zero-day exploitation Targets Defense, aerospace, and aviation firms in Europe and India Scale At least 17 compromised relay servers; global reach Status Microsoft patched CVE-2026-68820 on August 11, 2026 Source Check Point Research; Microsoft Patch Tuesday TL;DR Lazarus resurfaced with a fresh wave of its Operation Dream Job campaign.

Lazarus Group is exploiting a recently patched Windows zero-day, CVE-2026-68820, to deliver a new backdoor called Troy against defense and aerospace targets in France, Germany, Brazil, and India through Operation Dream Job. The campaign uses fake recruiter lures, trojanized PDF software, and compromised legitimate sites and servers to spread MISTPEN, ForestTiger,...

North Korean hackers linked to Lazarus are exploiting the Windows zero-day CVE-2026-68820 in the Operation Dream Job campaign to gain SYSTEM privileges on targeted systems. The attacks have focused on defense, aerospace, and aviation organizations, while also using the FudModule rootkit, the Troy backdoor, and the RelayShell web shell to expand access and evade defenses. #CVE-2026-68820 #Lazarus #OperationDreamJob #FudModule #Troy #RelayShell #Roundcube

Mitglieder der vermutlich nordkoreanischen Hackergruppe Lazarus APT haben ihre Operation DreamJob mit einer neuen Kampagne fortgesetzt. Der Artikel <a href="https://tarnkappe.info/artikel/it-sicherheit/operation-dreamjob-lazarus-apt-hat-es-auf-die-nuklearindustrie-abgesehen-306744.html">Operation DreamJob: Lazarus APT hat es auf die Nuklearindustrie abgesehen</a> erschien zuerst auf <a href="https://tarnkappe.info">TARNKAPPE.INFO</a>