North Korea-aligned Lazarus Targets Drone Sector (ScoringMathTea via BinMergeLoader) and DeceptiveDevelopment Targets Software Repositories (ESET APT Activity Report Q2-Q3 2026)

Key facts

Detection coverage

As of 2026-11-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5638 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: ScoringMathTea and DeceptiveDevelopment C2: ESET IOCs, Community Siblings and BinMergeLoader Graph API Use

C2 phase. Flags outbound connections to ESET-published ScoringMathTea, BeaverTail, AkdoorTea and Tropidoor infrastructure, community-observed sibling infrastructure tagged separately as OSINT-tier corroboration, BinMergeLoader-style Microsoft Graph API calls from executables that have no business using it (wksprt.exe, WinMerge, Notepad++, MuPDF, TightVNC) and any network activity from the side-loading host executables. ScoringMathTea C2 rides compromised legitimate WordPress sites with symmetric-encrypted HTTP/HTTPS traffic (TL-2026-5638).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1071.001, T1573.001, T1584.004
• Data sources: sysmon
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3 Initiated=true earliest=-24h
| eval dest=lower(coalesce(DestinationHostname,"")), img=lower(Image)
| eval ioc_tier=case(
    match(dest,"(^|\\.)(coralsunmarine\\.com|kazitradebd\\.com|oldlinewoodwork\\.com|pierregems\\.com|spaincaramoon\\.com|driverservices\\.store)$") OR in(DestinationIp,"23.111.133.162","95.217.119.214","45.159.248.110","103.231.75.101","45.8.146.93","86.104.72.247","103.35.190.170","199.188.200.147"), "eset_published_c2",
    match(dest,"(^|\\.)(api-webvision\\.com|security\\.cortivas\\.us|iwnw-1knwni-21siw\\.xo\\.je)$") OR in(DestinationIp,"5.199.169.240","92.112.53.209","151.241.99.99","5.196.82.35"), "community_osint_sibling",
    dest="graph.microsoft.com" AND match(img,"\\\\\\\\(wksprt|wkspbroker|winmergeu|notepad\\+\\+|mupdf|tvnserver|tvnviewer)\\.exe$"), "binmergeloader_graph_api",
    match(img,"\\\\\\\\(wksprt|wkspbroker)\\.exe$"), "sideload_host_network",
    true(), null())
| where isnotnull(ioc_tier)
| stats count min(_time) as first_seen max(_time) as last_seen dc(DestinationIp) as dest_ips values(DestinationHostname) as dest_hosts values(DestinationIp) as dest_addrs by host, Image, ioc_tier
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

let eset_domains = dynamic(["coralsunmarine.com","kazitradebd.com","oldlinewoodwork.com","pierregems.com","spaincaramoon.com","driverservices.store"]);
let eset_ips = dynamic(["23.111.133.162","95.217.119.214","45.159.248.110","103.231.75.101","45.8.146.93","86.104.72.247","103.35.190.170","199.188.200.147"]);
let community_domains = dynamic(["api-webvision.com","security.cortivas.us","iwnw-1knwni-21siw.xo.je"]);
let community_ips = dynamic(["5.199.169.240","92.112.53.209","151.241.99.99","5.196.82.35"]);
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where ActionType in ("ConnectionSuccess","ConnectionAttempt")
| extend Host = tolower(RemoteUrl)
| extend IocTier = case(
    Host has_any (eset_domains) or RemoteIP in (eset_ips), "eset_published_c2",
    Host has_any (community_domains) or RemoteIP in (community_ips), "community_osint_sibling",
    Host has "graph.microsoft.com" and InitiatingProcessFileName in~ ("wksprt.exe","wkspbroker.exe","WinMergeU.exe","notepad++.exe","mupdf.exe","tvnserver.exe","tvnviewer.exe"), "binmergeloader_graph_api",
    InitiatingProcessFileName in~ ("wksprt.exe","wkspbroker.exe"), "sideload_host_network",
    "")
| where IocTier != ""
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, RemoteUrl, RemoteIP, RemotePort, IocTier
| order by Timestamp desc

Sigma

title: ScoringMathTea and DeceptiveDevelopment C2: ESET IOCs, Community Siblings and BinMergeLoader Graph API Use
id: c5d81b94-6e03-4a7f-9d28-e4b1f7a30c03
status: experimental
description: Detects network connections associated with ScoringMathTea and DeceptiveDevelopment C2 for TL-2026-5638 - ESET-published C2 domains and IPs (several are compromised legitimate sites, verify before blocking), community-observed sibling infrastructure (OSINT tier, corroboration only), BinMergeLoader Microsoft Graph API use from lure-bundled executables, and any network activity from wksprt.exe / wkspbroker.exe.
references:
    - https://www.welivesecurity.com/en/eset-research/gotta-fly-lazarus-targets-uav-sector/
    - https://github.com/eset/malware-ioc
author: Threadlinqs Team
date: 2026-11-10
tags:
    - attack.command-and-control
    - attack.t1071.001
    - attack.t1573.001
    - attack.resource-development
    - attack.t1584.004
logsource:
    category: network_connection
    product: windows
detection:
    selection_domains:
        DestinationHostname|endswith:
            - 'coralsunmarine.com'
            - 'kazitradebd.com'
            - 'oldlinewoodwork.com'
            - 'pierregems.com'
            - 'spaincaramoon.com'
            - 'driverservices.store'
            - 'api-webvision.com'
            - 'security.cortivas.us'
            - 'iwnw-1knwni-21siw.xo.je'
    selection_ips:
        DestinationIp:
            - '23.111.133.162'
            - '95.217.119.214'
            - '45.159.248.110'
            - '103.231.75.101'
            - '45.8.146.93'
            - '86.104.72.247'
            - '103.35.190.170'
            - '199.188.200.147'
            - '5.199.169.240'
            - '92.112.53.209'
            - '151.241.99.99'
            - '5.196.82.35'
    selection_graph:
        DestinationHostname: 'graph.microsoft.com'
        Image|endswith:
            - '\wksprt.exe'
            - '\wkspbroker.exe'
            - '\WinMergeU.exe'
            - '\notepad++.exe'
            - '\mupdf.exe'
            - '\tvnserver.exe'
            - '\tvnviewer.exe'
    selection_sideload_host:
        Image|endswith:
            - '\wksprt.exe'
            - '\wkspbroker.exe'
        Initiated: 'true'
    condition: 1 of selection_*
falsepositives:
    - ESET-listed domains that are compromised legitimate websites may be visited by users for unrelated reasons
    - Genuine Windows RemoteApp (wksprt.exe) sessions to corporate gateways
level: high

Known false positives:

• Legitimate visits to compromised-but-benign sites listed by ESET before remediation
• Genuine Windows RemoteApp sessions via wksprt.exe to corporate gateways

Tuning notes: Treat ESET-listed domains on CDN-fronted hosts (e.g. kazitradebd.com) as hunt leads, not block decisions. Community-tier siblings (ioc_tier=community_osint_sibling) are lower confidence: route to triage rather than auto-containment. Extend the Graph API process list with lure binaries observed locally.

• 🔒 Lazarus DreamJob Trojanized Loader DLL Image-Load via wksprt.exe or Lure Components · unlock with TL Creds
• 🔒 DeceptiveDevelopment node.exe Child Processes and InvisibleFerret Python RAT Activity · unlock with TL Creds
• 🔒 Lazarus / DeceptiveDevelopment C2 Connections and Graph API Abuse from Lure-Bundled Executables · unlock with TL Creds
• 🔒 Lazarus DreamJob Loader DLL Side-Loading (HideFirstLetter, libmupdf, TSMSISrv) · unlock with TL Creds
• 🔒 DeceptiveDevelopment BeaverTail / InvisibleFerret Process Chain · unlock with TL Creds
• 🔒 ScoringMathTea / BinMergeLoader C2 Network Connections · unlock with TL Creds
• 🔒 Lazarus DreamJob DLL Side-Loading of ScoringMathTea Loaders (BinMergeLoader, QuanPinLoader) · unlock with TL Creds
• 🔒 DeceptiveDevelopment BeaverTail Node.js Spawning Shells, InvisibleFerret Staging and AnyDesk Deployment · unlock with TL Creds

Indicators of compromise

As of 2026-11-10, Threadlinqs Intelligence tracks 26 indicators of compromise for TL-2026-5638.

Sample indicators (3 of 26)

• IP address: 23.111.133[.]162
• Domain: coralsunmarine[.]com
• File hash: 71D0DDB7C6CAC4BA2BDE679941FA92A31FBEC1FF

Defanged, TLP:CLEAR. Full set of 26 indicators: unlock with TL Creds.

Technical analysis

The two operations are distinct.

Scope and sourcing. This record is built from the GBHackers article of 2026-11-10, ESET's WeLiveSecurity summary of the APT Activity Report Q2 2026-Q3 2026 (published 2026-10-28, covering April-September 2026), and two earlier ESET technical write-ups that document the tooling in depth: the Operation DreamJob 'Gotta Fly' investigation (October 2025) and the DeceptiveDevelopment research. The Q2-Q3 2026 ESET PDF could not be read in this run (binary content only). The ESET summary page does not itself name ScoringMathTea, BinMergeLoader, BeaverTail or InvisibleFerret; those names come from the GBHackers article and from ESET's earlier reports. All network and file IOCs below were published by ESET in those earlier reports (Oct 2025 DreamJob and the DeceptiveDevelopment report), not in the Q2-Q3 2026 summary. The BeaconBeagle API returned HTTP 502 for the lookups attempted, so no C2 correlation could be recorded.

Lazarus and the drone sector. Per ESET, Lazarus resumed targeting drone-sector organizations, typically gaining initial access through recruitment-themed social engineering. ESET's stated motive assessment is that drones play a growing role in the war in Ukraine, and that access to that knowledge and to manufacturing processes could help North Korea build its own drone production. The ESET summary does not name countries for the drone campaign, and the GBHackers article says proprietary information and manufacturing know-how were likely collection priorities but does not confirm any theft. The principal payload is ScoringMathTea, a remote access trojan with about 40 commands. It is delivered through loaders such as BinMergeLoader, which retrieves further payloads through Microsoft Graph API infrastructure using Microsoft API tokens, with AES-encrypted traffic over HTTP/HTTPS.

Tradecraft documented by ESET for the DreamJob cluster (October 2025): fake job offers with a decoy job description and a trojanized PDF reader (MuPDF); trojanized open-source projects (TightVNC, MuPDF, libpcre 8.45, DirectX wrappers, WinMerge plugins DisplayBinaryFiles and HideFirstLetter, Notepad++ plugins ComparePlus and NPPHexEditor, and a Sample IME-based loader called QuanPinLoader); DLL side-loading and proxying by malicious DLLs that masquerade as Microsoft or RemoteApp libraries and are loaded by legitimate executables (wksprt.exe, wkspbroker.exe); loaders that decrypt the next stage (AES-128 or ChaCha20) and run it in memory via MemoryModule; and ScoringMathTea C2 over compromised WordPress and other legitimate web servers, with IDEA-encrypted, base64-encoded traffic. Victims in that October 2025 investigation were a metal engineering company in Southeastern Europe, an aircraft-component manufacturer in Central Europe, and a defense company in Central Europe; at least two of the three defense-related companies worked on UAV technology. A drone-themed internal filename (DroneEXEHijackingLoader.dll) was observed.

DeceptiveDevelopment and repositories. ESET describes DeceptiveDevelopment as North Korea-aligned and financially motivated, active since at least 2023, overlapping with Contagious Interview, DEV#POPPER and Void Dokkaebi. In this reporting period it shifted from fake job-interview lures to broader software supply-chain compromise: harvesting developer credentials and using that access to inject malicious code into public and private repositories. Earlier ESET research documents its toolset: BeaverTail and OtterCookie (JavaScript infostealers/downloaders), InvisibleFerret (modular Python RAT), WeaselStore/GolangGhost, TsunamiKit, Tropidoor (code shared with Lazarus's PostNapTea) and AkdoorTea; lures include fake recruiter profiles, trojanized coding challenges hosted in GitHub/GitLab/Bitbucket repositories, and ClickFix-style fake interview sites. Targets are developers on Windows, Linux and macOS, especially in cryptocurrency and Web3. ESET's broader DPRK summary says targets are mainly technology and cryptocurrency companies and software developers, South Korea remains a key target, and Ukraine has become more prominent.

Caveats. The sources state the Lazarus and DeceptiveDevelopment operations are distinct. The GBHackers article also mentions Gamaredon and a Turla-linked script (Rezzuar); that is separate, non-DPRK activity and is not covered by this record. No CVE is involved; access is by social engineering and credential theft.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027.007 Obfuscated Files or Information: Dynamic API Resolution; T1078 Valid Accounts; T1140 Deobfuscate/Decode Files or Information; T1620 Reflective Code Loading

Collection

T1056.001 Input Capture: Keylogging

Execution

T1059 Command and Scripting Interpreter; T1204.002 User Execution: Malicious File

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1573.001 Encrypted Channel: Symmetric Cryptography

Discovery

T1082 System Information Discovery

Initial Access

T1195.002 Supply Chain Compromise: Compromise Software Supply Chain; T1566.002 Phishing: Spearphishing Link

stealth

T1574.001 DLL

Resource Development

T1584.004 Compromise Infrastructure: Server; T1585.001 Establish Accounts: Social Media Accounts; T1587.001 Develop Capabilities: Malware

Remediation

Immediate actions

• Hunt for DLL side-loading of trojanized WinMerge/Notepad++/MuPDF/TightVNC components and legitimate EXEs such as wksprt.exe and wkspbroker.exe loading unsigned DLLs from user-writable paths
• Review outbound Microsoft Graph API traffic from workstations that have no business use for it, and unexpected OAuth/API tokens
• Rotate developer credentials, personal access tokens and SSH keys for any developer who ran an unsolicited coding assessment or interview tool; audit recent commits and CI changes in public and private repositories
• Search network telemetry for the ESET-published C2 domains and IPs, noting that several are compromised legitimate sites

Workarounds

• Block or alert on terminal commands pasted from fake interview/camera-fix pages (ClickFix pattern)
• Apply allowlisting for DLL loads by the named legitimate executables

Longer-term hardening

• Enforce phishing-resistant MFA and short-lived tokens on source code hosting platforms; require signed commits and branch protection with review
• Run unsolicited candidate coding tests and recruiter-supplied software only in isolated, disposable environments
• Restrict installation of unvetted portable open-source tools and plugins on engineering and defense-industry workstations
• Deploy EDR with behavioral detection for in-memory loading (MemoryModule-style) and DLL proxying

Affected and fixed versions

• Open-source projects (trojanized by the actor) — WinMerge plugins (DisplayBinaryFiles, HideFirstLetter)
• Open-source projects (trojanized by the actor) — Notepad++ plugins (ComparePlus, NPPHexEditor)
• Open-source projects (trojanized by the actor) — MuPDF, TightVNC, libpcre 8.45
• Source code hosting — Public and private software repositories (GitHub, GitLab, Bitbucket used for lures)

Timeline

• 2023-11-01 Unit 42 reports Contagious Interview, the first public reporting of DeceptiveDevelopment activity (month precision per ESET).
• 2024-06-05 Earliest first-seen date among ScoringMathTea C2 servers published by ESET (mediostresbarbas.com.ar, a compromised legitimate site).
• 2024-11-28 Tropidoor, a DeceptiveDevelopment RAT sharing code with Lazarus's PostNapTea, first seen.
• 2025-03-01 ClickFix fake-interview lures first reported on macOS and Windows (month precision); a Linux variant followed in September 2025.
• 2025-10-01 ESET investigation of Operation DreamJob (month precision): trojanized open-source loaders delivering ScoringMathTea at three defense/aerospace-related companies in Central and Southeastern Europe.
• 2026-04-01 Start of the ESET APT Activity Report Q2-Q3 2026 coverage period (April-September 2026).
• 2026-10-28 ESET publishes the APT Activity Report Q2 2026-Q3 2026: Lazarus resumes drone-sector targeting; DeceptiveDevelopment shifts to repository compromise via harvested developer credentials.
• 2026-11-10 GBHackers publishes coverage naming ScoringMathTea, BinMergeLoader (Microsoft Graph API), BeaverTail and InvisibleFerret.

Sources cited

• ESET APT Activity Report Q2 2026-Q3 2026 (WeLiveSecurity) ESET WeLiveSecurity · Research · 2026-10-28
• ESET APT Activity Report Q2 2026-Q3 2026 (PDF) web-assets.esetstatic.com · Research · 2026-10-28
• ESET: Operation DreamJob 'Gotta Fly' - Lazarus targets the UAV sector ESET WeLiveSecurity · Research
• ESET: DeceptiveDevelopment - from primitive crypto theft to sophisticated AI-based deception ESET WeLiveSecurity · Research
• ESET malware-ioc repository (deceptivedevelopment indicators) GitHub · Code repository
• North Korean Hackers Target Drone Technology and Software Supply Chains in New Cyberespionage Campaigns (GBHackers) gbhackers.com · News · 2026-11-10
• Help Net Security: Oil shipments, drone makers, and a poisoned code library targeted in recent APT campaigns (ESET Q4 2025-Q1 2026 report) Help Net Security · News · 2026-05-28

More in apt

• North Korean Lazarus (Operation DreamJob) and DeceptiveDevelopment Target Drone Technology and Software Supply Chains
• CopperDragon Sparrow Framework: SilentDelivery, OceanGate and DarkWire Campaigns (China-nexus)
• Turla (Secret Blizzard) Cereal modular .NET toolset targets government Microsoft Exchange servers
• TraderTraitor (DPRK-aligned) FLATROOF and ROOFDECK macOS Backdoors Resurface on IT Services Victim With No Crypto Ties
• CRAFTY FALCON targets Indian fintechs via exposed APIs during weekends and low-monitoring periods

More from Lazarus Group

• The Mac Malware of 2023: macOS Ransomware, Stealers, and DPRK/Iran-Linked APT Malware (Objective-See Annual Review)
• North Korean Threat Actors Operationalize AI Across Tradecraft (Jade/Coral/Jasper/Diamond/Onyx/Pearl/Sapphire/Emerald Sleet; ProcmacSteal)
• NSFOCUS Monthly APT Insights August 2026: Lazarus MISTPEN/ForestTiger/RelayShell Campaign with CVE-2026-68820, UAC-0099 LUNCHPOKE/BURNYBEAR/MATCHBOIL.V2, CVE-2026-42897 Exchange OWA Exploitation
• Operation FlashHole: Lazarus watering-hole and spear-phishing campaign abusing INISAFE CrossWeb EX against South Korean organizations
• Weekly threat digest (week ending 2026-06-07): PAN-OS GlobalProtect CVE-2026-0257 exploitation, React2Shell CVE-2025-55182 abuse by APT-C-26, and npm/state-actor campaigns
• Bitget Exchange Loses ~$351.6M (On-Chain: ~$356.9M) in Suspected North Korean (TraderTraitor) Backend Compromise and Authorization-Flow Abuse