Os investigadores da ESET detetaram uma nova campanha da Operação DreamJob, conduzida pelo grupo Lazarus.

Researchers at ESET said they found evidence of a new tentacle of the long-running Operation DreamJob campaign — where North Korea’s Lazarus group sends malware-laden emails purporting to be from recruiters at top companies.

Researchers at ESET said they found evidence of a new tentacle of the long-running Operation DreamJob campaign — where North Korea’s Lazarus group sends malware-laden emails purporting to be from recr...

Researchers at ESET said they found evidence of a new tentacle of the long-running Operation DreamJob campaign — where North Korea’s Lazarus group sends malware-laden emails purporting to be from recr...

Researchers at ESET said they found evidence of a new tentacle of the long-running Operation DreamJob campaign — where North Korea’s Lazarus group sends malware-laden emails purporting to be from recruiters at top companies.

Introduction A new chapter in the modern cyber battlefield has opened, and it begins with a shadow slipping through the networks that power Ukraine’s unmanned aerial defense. That shadow has a name—ScoringMathTea, a modular C++ remote-access trojan operated by the notorious Lazarus Group. Its mission: to infiltrate, persist, and quietly extract intelligence from UAV defense contractors. The attack chain is coldly precise, engineered with layers of deception—polyalphabetic decryption, reflective injection, hashed API calls, and encrypted command-and-control pathways.

Introduction: The Lazarus APT group, a sophisticated state-sponsored actor, continues to evolve its tradecraft, employing advanced obfuscation techniques to hide in plain sight. A recent analysis of their "ScoringMathTea" RAT uncovered a novel string obfuscation method using a custom alphabet, presenting a significant hurdle for static analysis. This article delves into the technical specifics of this technique and provides actionable tools and methodologies for defenders to deobfuscate such threats, turning an evasion tactic into a powerful detection opportunity.

北朝鮮のハッカー集団Lazarus Groupが、魅力的な偽求人でヨーロッパの防衛産業エンジニアを標的とした新たなサイバー攻撃を展開。ESETの研究者が2025年3月から観測した攻撃では、UAV技術の窃取が目的とされ、トロイの木馬化されたPDFリーダーとScoringMathTeaマルウェアが使用されている。

The Lazarus APT Group, an advanced persistent threat (APT) attributed to North Korea, has deployed a sophisticated new Remote Access Trojan (RAT) called ScoringMathTea.

North Korean Lazarus Group targets European defense firms with ScoringMathTea malware in new espionage wave.

北朝鮮のハッカー集団Lazarus Groupが、魅力的な偽求人でヨーロッパの防衛産業エンジニアを標的とした新たなサイバー攻撃を展開。ESETの研究者が2025年3月から観測した攻撃では、UAV技術の窃取が目的とされ、トロイの木馬化されたPDFリーダーとScoringMathTeaマルウェアが使用されている。

Researchers at ESET said they found evidence of a new tentacle of the long-running Operation DreamJob campaign — where North Korea’s Lazarus group sends malware-laden emails purporting to be from recr...

North Korean Lazarus Group targets European defense firms with ScoringMathTea malware in new espionage wave.

Researchers at ESET said they found evidence of a new tentacle of the long-running Operation DreamJob campaign — where North Korea’s Lazarus group sends malware-laden emails purporting to be from recruiters at top companies.

Researchers at ESET said they found evidence of a new tentacle of the long-running Operation DreamJob campaign — where North Korea’s Lazarus group sends malware-laden emails purporting to be from recruiters at top companies.