# North Korea-aligned Lazarus Targets Drone Sector (ScoringMathTea via BinMergeLoader) and DeceptiveDevelopment Targets Software Repositories (ESET APT Activity Report Q2-Q3 2026) > ESET's APT Activity Report (published 2026-10-28, covering April-September 2026) says Lazarus resumed targeting the drone sector with recruitment-themed social engineering, and DeceptiveDevelopment moved from fake job-interview lures to harvesting developer credentials and injecting malicious code into public and private source code repositories. The two operations are distinct. - **Published:** 2026-11-10T11:08:01Z - **Last reviewed:** 2026-11-10T11:08:01Z - **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5638 - **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5638.png - **ID:** TL-2026-5638 - **Severity:** HIGH - **Category:** APT - **Status:** ACTIVE - **Actor:** Lazarus Group (North Korea) - **Detections:** 9 (1 shown free below) ยท **IOCs:** 26 (3 shown free below) ## Description Scope and sourcing. This record is built from the GBHackers article of 2026-11-10, ESET's WeLiveSecurity summary of the APT Activity Report Q2 2026-Q3 2026 (published 2026-10-28, covering April-September 2026), and two earlier ESET technical write-ups that document the tooling in depth: the Operation DreamJob 'Gotta Fly' investigation (October 2025) and the DeceptiveDevelopment research. The Q2-Q3 2026 ESET PDF could not be read in this run (binary content only). The ESET summary page does not itself name ScoringMathTea, BinMergeLoader, BeaverTail or InvisibleFerret; those names come from the GBHackers article and from ESET's earlier reports. All network and file IOCs below were published by ESET in those earlier reports (Oct 2025 DreamJob and the DeceptiveDevelopment report), not in the Q2-Q3 2026 summary. The BeaconBeagle API returned HTTP 502 for the lookups attempted, so no C2 correlation could be recorded. Lazarus and the drone sector. Per ESET, Lazarus resumed targeting drone-sector organizations, typically gaining initial access through recruitment-themed social engineering. ESET's stated motive assessment is that drones play a growing role in the war in Ukraine, and that access to that knowledge and to manufacturing processes could help North Korea build its own drone production. The ESET summary does not name countries for the drone campaign, and the GBHackers article says proprietary information and manufacturing know-how were likely collection priorities but does not confirm any theft. The principal payload is ScoringMathTea, a remote access trojan with about 40 commands. It is delivered through loaders such as BinMergeLoader, which retrieves further payloads through Microsoft Graph API infrastructure using Microsoft API tokens, with AES-encrypted traffic over HTTP/HTTPS. Tradecraft documented by ESET for the DreamJob cluster (October 2025): fake job offers with a decoy job description and a trojanized PDF reader (MuPDF); trojanized open-source projects (TightVNC, MuPDF, libpcre 8.45, DirectX wrappers, WinMerge plugins DisplayBinaryFiles and HideFirstLetter, Notepad++ plugins ComparePlus and NPPHexEditor, and a Sample IME-based loader called QuanPinLoader); DLL side-loading and proxying by malicious DLLs that masquerade as Microsoft or RemoteApp libraries and are loaded by legitimate executables (wksprt.exe, wkspbroker.exe); loaders that decrypt the next stage (AES-128 or ChaCha20) and run it in memory via MemoryModule; and ScoringMathTea C2 over compromised WordPress and other legitimate web servers, with IDEA-encrypted, base64-encoded traffic. Victims in that October 2025 investigation were a metal engineering company in Southeastern Europe, an aircraft-component manufacturer in Central Europe, and a defense company in Central Europe; at least two of the three defense-related companies worked on UAV technology. A drone-themed internal filename (DroneEXEHijackingLoader.dll) was observed. DeceptiveDevelopment and repositories. ESET describes DeceptiveDevelopment as North Korea-aligned and financially motivated, active since at least 2023, overlapping with Contagious Interview, DEV#POPPER and Void Dokkaebi. In this reporting period it shifted from fake job-interview lures to broader software supply-chain compromise: harvesting developer credentials and using that access to inject malicious code into public and private repositories. Earlier ESET research documents its toolset: BeaverTail and OtterCookie (JavaScript infostealers/downloaders), InvisibleFerret (modular Python RAT), WeaselStore/GolangGhost, TsunamiKit, Tropidoor (code shared with Lazarus's PostNapTea) and AkdoorTea; lures include fake recruiter profiles, trojanized coding challenges hosted in GitHub/GitLab/Bitbucket repositories, and ClickFix-style fake interview sites. Targets are developers on Windows, Linux and macOS, especially in cryptocurrency and Web3. ESET's broader DPRK summary says targets are mainly technology and cryptocurrency companies and software developers, South Korea remains a key target, and Ukraine has become more prominent. Caveats. The sources state the Lazarus and DeceptiveDevelopment operations are distinct. The GBHackers article also mentions Gamaredon and a Turla-linked script (Rezzuar); that is separate, non-DPRK activity and is not covered by this record. No CVE is involved; access is by social engineering and credential theft. ## MITRE ATT&CK - T1584.004 Compromise Infrastructure: Server - T1585.001 Establish Accounts: Social Media Accounts - T1587.001 Develop Capabilities: Malware - T1566.002 Phishing: Spearphishing Link - T1195.002 Supply Chain Compromise: Compromise Software Supply Chain - T1204.002 User Execution: Malicious File - T1059 Command and Scripting Interpreter - T1574.001 DLL - T1140 Deobfuscate/Decode Files or Information - T1620 Reflective Code Loading - T1027.007 Obfuscated Files or Information: Dynamic API Resolution - T1078 Valid Accounts - T1082 System Information Discovery - T1056.001 Input Capture: Keylogging - T1071.001 Application Layer Protocol: Web Protocols - T1573.001 Encrypted Channel: Symmetric Cryptography ## Free detection (Splunk SPL, Microsoft KQL, Sigma) **ScoringMathTea and DeceptiveDevelopment C2: ESET IOCs, Community Siblings and BinMergeLoader Graph API Use** (`TL-2026-5638-SPL-003`) C2 phase. Flags outbound connections to ESET-published ScoringMathTea, BeaverTail, AkdoorTea and Tropidoor infrastructure, community-observed sibling infrastructure tagged separately as OSINT-tier corroboration, BinMergeLoader-style Microsoft Graph API calls from executables that have no business using it (wksprt.exe, WinMerge, Notepad++, MuPDF, TightVNC) and any network activity from the side-loading host executables. ScoringMathTea C2 rides compromised legitimate WordPress sites with symmetric-encrypted HTTP/HTTPS traffic (TL-2026-5638). - **Languages:** Splunk SPL, Microsoft KQL, Sigma - **ATT&CK:** T1071.001, T1573.001, T1584.004 - **Data sources:** sysmon - **Severity:** high - **Confidence:** high ### Splunk SPL ```spl index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3 Initiated=true earliest=-24h | eval dest=lower(coalesce(DestinationHostname,"")), img=lower(Image) | eval ioc_tier=case( match(dest,"(^|\\.)(coralsunmarine\\.com|kazitradebd\\.com|oldlinewoodwork\\.com|pierregems\\.com|spaincaramoon\\.com|driverservices\\.store)$") OR in(DestinationIp,"23.111.133.162","95.217.119.214","45.159.248.110","103.231.75.101","45.8.146.93","86.104.72.247","103.35.190.170","199.188.200.147"), "eset_published_c2", match(dest,"(^|\\.)(api-webvision\\.com|security\\.cortivas\\.us|iwnw-1knwni-21siw\\.xo\\.je)$") OR in(DestinationIp,"5.199.169.240","92.112.53.209","151.241.99.99","5.196.82.35"), "community_osint_sibling", dest="graph.microsoft.com" AND match(img,"\\\\\\\\(wksprt|wkspbroker|winmergeu|notepad\\+\\+|mupdf|tvnserver|tvnviewer)\\.exe$"), "binmergeloader_graph_api", match(img,"\\\\\\\\(wksprt|wkspbroker)\\.exe$"), "sideload_host_network", true(), null()) | where isnotnull(ioc_tier) | stats count min(_time) as first_seen max(_time) as last_seen dc(DestinationIp) as dest_ips values(DestinationHostname) as dest_hosts values(DestinationIp) as dest_addrs by host, Image, ioc_tier | convert ctime(first_seen) ctime(last_seen) ``` ### Microsoft KQL ```kql let eset_domains = dynamic(["coralsunmarine.com","kazitradebd.com","oldlinewoodwork.com","pierregems.com","spaincaramoon.com","driverservices.store"]); let eset_ips = dynamic(["23.111.133.162","95.217.119.214","45.159.248.110","103.231.75.101","45.8.146.93","86.104.72.247","103.35.190.170","199.188.200.147"]); let community_domains = dynamic(["api-webvision.com","security.cortivas.us","iwnw-1knwni-21siw.xo.je"]); let community_ips = dynamic(["5.199.169.240","92.112.53.209","151.241.99.99","5.196.82.35"]); DeviceNetworkEvents | where Timestamp > ago(24h) | where ActionType in ("ConnectionSuccess","ConnectionAttempt") | extend Host = tolower(RemoteUrl) | extend IocTier = case( Host has_any (eset_domains) or RemoteIP in (eset_ips), "eset_published_c2", Host has_any (community_domains) or RemoteIP in (community_ips), "community_osint_sibling", Host has "graph.microsoft.com" and InitiatingProcessFileName in~ ("wksprt.exe","wkspbroker.exe","WinMergeU.exe","notepad++.exe","mupdf.exe","tvnserver.exe","tvnviewer.exe"), "binmergeloader_graph_api", InitiatingProcessFileName in~ ("wksprt.exe","wkspbroker.exe"), "sideload_host_network", "") | where IocTier != "" | project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, RemoteUrl, RemoteIP, RemotePort, IocTier | order by Timestamp desc ``` ### Sigma ```yaml title: ScoringMathTea and DeceptiveDevelopment C2: ESET IOCs, Community Siblings and BinMergeLoader Graph API Use id: c5d81b94-6e03-4a7f-9d28-e4b1f7a30c03 status: experimental description: Detects network connections associated with ScoringMathTea and DeceptiveDevelopment C2 for TL-2026-5638 - ESET-published C2 domains and IPs (several are compromised legitimate sites, verify before blocking), community-observed sibling infrastructure (OSINT tier, corroboration only), BinMergeLoader Microsoft Graph API use from lure-bundled executables, and any network activity from wksprt.exe / wkspbroker.exe. references: - https://www.welivesecurity.com/en/eset-research/gotta-fly-lazarus-targets-uav-sector/ - https://github.com/eset/malware-ioc author: Threadlinqs Team date: 2026-11-10 tags: - attack.command-and-control - attack.t1071.001 - attack.t1573.001 - attack.resource-development - attack.t1584.004 logsource: category: network_connection product: windows detection: selection_domains: DestinationHostname|endswith: - 'coralsunmarine.com' - 'kazitradebd.com' - 'oldlinewoodwork.com' - 'pierregems.com' - 'spaincaramoon.com' - 'driverservices.store' - 'api-webvision.com' - 'security.cortivas.us' - 'iwnw-1knwni-21siw.xo.je' selection_ips: DestinationIp: - '23.111.133.162' - '95.217.119.214' - '45.159.248.110' - '103.231.75.101' - '45.8.146.93' - '86.104.72.247' - '103.35.190.170' - '199.188.200.147' - '5.199.169.240' - '92.112.53.209' - '151.241.99.99' - '5.196.82.35' selection_graph: DestinationHostname: 'graph.microsoft.com' Image|endswith: - '\wksprt.exe' - '\wkspbroker.exe' - '\WinMergeU.exe' - '\notepad++.exe' - '\mupdf.exe' - '\tvnserver.exe' - '\tvnviewer.exe' selection_sideload_host: Image|endswith: - '\wksprt.exe' - '\wkspbroker.exe' Initiated: 'true' condition: 1 of selection_* falsepositives: - ESET-listed domains that are compromised legitimate websites may be visited by users for unrelated reasons - Genuine Windows RemoteApp (wksprt.exe) sessions to corporate gateways level: high ``` **Known false positives:** - Legitimate visits to compromised-but-benign sites listed by ESET before remediation - Genuine Windows RemoteApp sessions via wksprt.exe to corporate gateways **Tuning notes:** Treat ESET-listed domains on CDN-fronted hosts (e.g. kazitradebd.com) as hunt leads, not block decisions. Community-tier siblings (ioc_tier=community_osint_sibling) are lower confidence: route to triage rather than auto-containment. Extend the Graph API process list with lure binaries observed locally. ### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds - Lazarus DreamJob Trojanized Loader DLL Image-Load via wksprt.exe or Lure Components (locked: unlock with TL Creds) - DeceptiveDevelopment node.exe Child Processes and InvisibleFerret Python RAT Activity (locked: unlock with TL Creds) - Lazarus / DeceptiveDevelopment C2 Connections and Graph API Abuse from Lure-Bundled Executables (locked: unlock with TL Creds) - Lazarus DreamJob Loader DLL Side-Loading (HideFirstLetter, libmupdf, TSMSISrv) (locked: unlock with TL Creds) - DeceptiveDevelopment BeaverTail / InvisibleFerret Process Chain (locked: unlock with TL Creds) - ScoringMathTea / BinMergeLoader C2 Network Connections (locked: unlock with TL Creds) - Lazarus DreamJob DLL Side-Loading of ScoringMathTea Loaders (BinMergeLoader, QuanPinLoader) (locked: unlock with TL Creds) - DeceptiveDevelopment BeaverTail Node.js Spawning Shells, InvisibleFerret Staging and AnyDesk Deployment (locked: unlock with TL Creds) Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup ## Sample indicators (3 of 26) Defanged, TLP:CLEAR. - IP address: `23.111.133[.]162` - Domain: `coralsunmarine[.]com` - File hash: `71D0DDB7C6CAC4BA2BDE679941FA92A31FBEC1FF` Full set of 26 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds ## Sources - [North Korean Hackers Target Drone Technology and Software Supply Chains in New Cyberespionage Campaigns (GBHackers)](https://gbhackers.com/drone-technology-targeted/) - [ESET APT Activity Report Q2 2026-Q3 2026 (WeLiveSecurity)](https://www.welivesecurity.com/en/eset-research/eset-apt-activity-report-q2-2026-q3-2026/) - [ESET APT Activity Report Q2 2026-Q3 2026 (PDF)](https://web-assets.esetstatic.com/wls/en/papers/threat-reports/eset-apt-activity-report-q2-2026-q3-2026.pdf) - [ESET: Operation DreamJob 'Gotta Fly' - Lazarus targets the UAV sector](https://www.welivesecurity.com/en/eset-research/gotta-fly-lazarus-targets-uav-sector/) - [ESET: DeceptiveDevelopment - from primitive crypto theft to sophisticated AI-based deception](https://welivesecurity.com/en/eset-research/deceptivedevelopment-from-primitive-crypto-theft-to-sophisticated-ai-based-deception) - [ESET malware-ioc repository (deceptivedevelopment indicators)](https://github.com/eset/malware-ioc) - [Help Net Security: Oil shipments, drone makers, and a poisoned code library targeted in recent APT campaigns (ESET Q4 2025-Q1 2026 report)](https://www.helpnetsecurity.com/2026/05/28/eset-apt-activity-report/) ## Full data The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp Canonical: https://intel.threadlinqs.com/threat/TL-2026-5638