North Korean Lazarus (Operation DreamJob) and DeceptiveDevelopment Target Drone Technology and Software Supply Chains

Key facts

Detection coverage

As of 2026-11-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5653 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: NullReceiver Blockchain C2 Lookup — Node.js Contacting Ethereum RPC or 166.88.134.62

Detects the NullReceiver loader used by DPRK-linked (Lazarus / DeceptiveDevelopment) trojanized npm packages such as bianira-ui@1.27.0 and fluid-type-ui@2.0.8. The loader reads the latest outgoing transaction of a hardcoded Ethereum wallet (0xa322e5f3d311d3080e6f0121063e9adc2490ef1a) through public RPC endpoints (1rpc.io, eth.drpc.org) and decodes the C2 IP (166.88.134.62) from the recipient address. A Node.js/Bun/Deno process resolving those RPC hosts or connecting to the decoded C2 on ports 80/443 on a developer or build host is the behavioural signature of this supply-chain stage (T1195.002, T1568, T1059.007).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1195.002, T1568, T1059.007, T1071.001
• Data sources: sysmon, microsoft_defender_for_endpoint
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
(EventCode=22 OR EventCode=3) Image IN ("*\\node.exe","*\\bun.exe","*\\deno.exe")
| where match(QueryName,"(?i)^(1rpc\\.io|eth\\.drpc\\.org)\\.?$") OR match(DestinationHostname,"(?i)^(1rpc\\.io|eth\\.drpc\\.org)\\.?$") OR DestinationIp="166.88.134.62"
| eval indicator=coalesce(QueryName, DestinationHostname, DestinationIp)
| stats count min(_time) as firstTime max(_time) as lastTime values(indicator) as indicators values(DestinationIp) as dest_ips values(DestinationPort) as dest_ports by host, User, Image
| eval firstTime=strftime(firstTime,"%Y-%m-%d %H:%M:%S"), lastTime=strftime(lastTime,"%Y-%m-%d %H:%M:%S")
| table firstTime lastTime host User Image indicators dest_ips dest_ports count

Microsoft KQL

let EthRpcHosts = dynamic(["1rpc.io","eth.drpc.org"]);
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("node.exe","bun.exe","deno.exe","node","bun","deno")
| where RemoteIP == "166.88.134.62" or RemoteUrl has_any (EthRpcHosts)
| summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), Connections=count(), RemoteIPs=make_set(RemoteIP, 10), RemoteUrls=make_set(RemoteUrl, 10), Ports=make_set(RemotePort, 10) by DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine

Sigma

title: Node.js Process Contacting Ethereum RPC Endpoints (NullReceiver Blockchain C2 Lookup)
id: 7c1d2e3f-4a5b-4c6d-8e9f-565300000001
status: experimental
description: Detects Node.js, Bun or Deno resolving public Ethereum RPC hosts (1rpc.io, eth.drpc.org) as used by the DPRK-linked NullReceiver loader in trojanized npm packages (bianira-ui, fluid-type-ui) to decode its C2 address (166.88.134.62) from a hardcoded wallet.
references:
    - https://www.welivesecurity.com/en/eset-research/eset-apt-activity-report-q2-2026-q3-2026/
    - https://opensourcemalware.com/blog/nullreceiver-dprk-c2-technique
    - https://welivesecurity.com/en/eset-research/gotta-fly-lazarus-targets-uav-sector
author: Threadlinqs Team
date: 2026-11-10
tags:
    - attack.initial-access
    - attack.t1195.002
    - attack.command-and-control
    - attack.t1568
    - attack.execution
    - attack.t1059.007
logsource:
    category: dns_query
    product: windows
detection:
    selection_proc:
        Image|endswith:
            - '\node.exe'
            - '\bun.exe'
            - '\deno.exe'
    selection_rpc:
        QueryName|endswith:
            - '1rpc.io'
            - 'eth.drpc.org'
    condition: selection_proc and selection_rpc
falsepositives:
    - Legitimate Web3/dApp developers whose Node.js tooling queries public Ethereum RPC providers
    - Blockchain indexers or wallet backends running on Node.js
level: high

Known false positives:

• Web3 / dApp developers running Node.js tooling that legitimately queries Ethereum RPC providers such as 1rpc.io or eth.drpc.org
• Blockchain indexer or wallet backend services built on Node.js

Tuning notes: Exclude known Web3 development hosts and service accounts by host or User. Extend the Image list for npx or Electron wrappers if your telemetry reports a different image. Ensure Sysmon DNS logging (EventCode 22) includes Node.js. Add other RPC providers (infura, alchemy, cloudflare-eth) only for hosts that have no Web3 business need.

• 🔒 Malicious NullReceiver npm Packages bianira-ui / fluid-type-ui Installed or Executed · unlock with TL Creds
• 🔒 DEV#POPPER Startup Injection — VS Code, Cursor or Discord Spawning Download/Exec Shells · unlock with TL Creds
• 🔒 Community-Observed DPRK-Linked Sibling C2 Infrastructure (TL_OSINT_Scan) · unlock with TL Creds
• 🔒 Trojanized SumatraPDF Launched From User-Writable Path (Operation DreamJob Lure) · unlock with TL Creds
• 🔒 OmniStealer-Style Developer Secret Harvesting — Node/Python Reading Keys, Tokens and Browser Stores · unlock with TL Creds
• 🔒 Known Lazarus DreamJob Loader and ScoringMathTea Hashes Loaded or Executed · unlock with TL Creds
• 🔒 DreamJob DLL Side-Loading — wksprt/wkspbroker webservices.dll & radcui.dll or Unsigned Notepad++ Plugin · unlock with TL Creds
• 🔒 ScoringMathTea and NullReceiver C2 Infrastructure — Connections to Known Lazarus/DPRK C2 Hosts · unlock with TL Creds

Indicators of compromise

As of 2026-11-10, Threadlinqs Intelligence tracks 28 indicators of compromise for TL-2026-5653.

Sample indicators (3 of 28)

• IP address: 166.88.134[.]62
• Domain: coralsunmarine[.]com
• URL: hxxps://1rpc[.]io/eth

Defanged, TLP:CLEAR. Full set of 28 indicators: unlock with TL Creds.

Community OSINT corroboration

3 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Technical analysis

Per ESET's APT Activity Report Q2 2026-Q3 2026 (published 28 October 2026) and coverage by Cyber Security News (10 November 2026), two North Korea-aligned clusters were active between April and September 2026.

Lazarus / Operation DreamJob resumed targeting the drone sector around June 2026, mainly European defense OEMs and unmanned aircraft system suppliers, using recruitment-themed social engineering. One Central European defense company received a password-protected ZIP containing a BAE Systems-themed job description PDF (with an incorrect header) plus a trojanized SumatraPDF viewer presented as necessary to open it. New tooling includes MortPusLoader (two trojanized Notepad++ plugins, replacing the earlier WinMerge-plugin loader BinMergeLoader), ScoringMathTea (aka ForestTiger) as the main payload, and LightlessTeaR, a rewrite of LightlessCan that implements common Windows commands internally rather than spawning command-line processes. Compromised Roundcube webmail servers at academic and government institutions in South America supported C2. ESET assesses the drone focus as likely motivated by the role of drones in the war in Ukraine and North Korea's drone manufacturing ambitions; this is an assessment, not proof of coordination with Russia. The earlier DreamJob UAV wave (ESET, 23 October 2025) used trojanized open-source projects (Notepad++/WinMerge plugins, MuPDF, TightVNC, libpcre, DirectX wrappers), DLL side-loading (webservices.dll, radcui.dll via wksprt.exe/wkspbroker.exe), in-memory loading with MemoryModule, AES-128/ChaCha20 staging, and ScoringMathTea (about 40 commands, IDEA-encrypted base64 C2 over HTTP/HTTPS to compromised WordPress sites).

DeceptiveDevelopment moved from fake job-interview lures to broad software supply-chain compromise: harvesting developer Git credentials, SSH keys and access tokens, then injecting malicious code into public and private repositories (often with rewritten commit history) and propagating through poisoned projects distributed via npm, the Go module mirror, Packagist, PyPI and browser extension marketplaces. Most compromised projects were small utilities maintained by individuals. Tooling includes NullReceiver, a blockchain-based C2 lookup loader that reads the most recent outgoing transaction of a hardcoded Ethereum wallet and decodes the C2 IP from the recipient address (so operators can rotate servers with another transaction); OmniStealer, a cross-platform Python infostealer targeting credentials, wallets, password managers and developer secrets; and DEV#POPPER RAT, whose updated versions inject code into VS Code, Cursor and Discord to run at application startup. A hidden VS Code task in a compromised repository can launch the lookup mechanism.

OpenSourceMalware's static analysis of the npm packages bianira-ui@1.27.0 and fluid-type-ui@2.0.8 (clones of Tailwind CSS plugins, attributed by that source to the DPRK Contagious Interview campaign) found the hardcoded wallet 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a, a zero-value transaction to the encoded recipient 0xa658863ea658863e68656c6c6f6970626f742121 decoding to 166.88.134.62 (trailing bytes 'helloipbot!!'), RPC lookups via 1rpc.io and eth.drpc.org, the marker A10-npm3!, and a Node.js RAT connecting to ports 443 and 80. Caveat: ESET stated it had not attributed DeceptiveDevelopment to a known actor, and linking NullReceiver specifically to ESET's DeceptiveDevelopment reporting is inferred from shared DPRK attribution and npm delivery. The public ESET summary contains no IOCs; the IOCs below come from the news article, OpenSourceMalware, and ESET's October 2025 DreamJob UAV research (lineage context).

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027.007 Obfuscated Files or Information: Dynamic API Resolution; T1140 Deobfuscate/Decode Files or Information; T1620 Reflective Code Loading

Discovery

T1057 Process Discovery; T1082 System Information Discovery

Execution

T1059.007 Command and Scripting Interpreter: JavaScript; T1129 Shared Modules; T1204.002 User Execution: Malicious File

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1568 Dynamic Resolution; T1573.001 Encrypted Channel: Symmetric Cryptography

Initial Access

T1195.002 Supply Chain Compromise: Compromise Software Supply Chain; T1566.003 Phishing: Spearphishing via Service

Credential Access

T1528 Steal Application Access Token; T1552.004 Unsecured Credentials: Private Keys; T1555.003 Credentials from Password Stores: Credentials from Web Browsers

stealth

T1574.001 DLL

Resource Development

T1584.004 Compromise Infrastructure: Server; T1587.001 Develop Capabilities: Malware

Remediation

Patches

• No CVE or vendor patch applies; remove malicious packages and reinstall clean versions of affected projects

Immediate actions

• Block 166.88.134.62 (ports 80/443) and the ScoringMathTea C2 domains/IPs listed in the IOCs at egress; hunt for historic connections
• Search lockfiles, node_modules and package caches for bianira-ui@1.27.0 and fluid-type-ui@2.0.8 and for the string A10-npm3!
• Alert on developer hosts querying Ethereum RPC endpoints (1rpc.io, eth.drpc.org) from Node.js processes
• Rotate Git credentials, SSH keys, npm/PyPI tokens and cloud secrets on any developer host that ran untrusted recruitment or coding-challenge projects
• Review recent commits in owned repositories for rewritten history, unexpected force-pushes and unfamiliar .vscode/tasks.json entries

Workarounds

• Allow-list Notepad++ and WinMerge plugins and block unsigned plugin DLLs
• Disable VS Code auto-run tasks and extension installs from untrusted sources on developer workstations

Longer-term hardening

• Train defense and UAV-sector staff and developers on fake recruiter and job-interview lures; prohibit running candidate-supplied software on corporate endpoints
• Enforce package pinning, lockfile review, provenance checks and private registry mirrors for npm, PyPI, Go and Packagist
• Require phishing-resistant MFA and short-lived tokens for source-control and package registries; restrict VS Code workspace auto-run tasks (Workspace Trust)
• Deploy EDR with detection for DLL side-loading, trojanized Notepad++ plugins and reflective DLL loading

Affected and fixed versions

• Various — Defense and UAV-sector organizations (Windows endpoints)
  Vulnerable versions: Hosts executing trojanized PDF viewers or Notepad++ plugins from recruitment lures
• npm — bianira-ui
  Vulnerable versions: 1.27.0
• npm — fluid-type-ui
  Vulnerable versions: 2.0.8
• Open-source ecosystems — npm, Go module mirror, Packagist, PyPI, browser extension marketplaces
  Vulnerable versions: Small utility projects with compromised maintainer credentials

Timeline

• 2022-10-01 ScoringMathTea first appears in VirusTotal submissions from Portugal and Germany with an Airbus-themed lure (ESET, Oct 2025 report).
• 2025-03-31 Late March 2025: ESET telemetry first observes the Operation DreamJob wave against European defense and UAV-sector companies.
• 2025-10-23 ESET publishes 'Gotta fly: Lazarus targets the UAV sector', documenting ScoringMathTea, BinMergeLoader and trojanized open-source loaders.
• 2026-04-01 Start of the April-September 2026 activity window covered by the ESET APT Activity Report Q2-Q3 2026.
• 2026-06-01 Around June 2026: Operation DreamJob resumes drone-sector targeting using MortPusLoader (trojanized Notepad++ plugins), LightlessTeaR and ScoringMathTea.
• 2026-08-02 OpenSourceMalware publishes analysis of NullReceiver in npm packages bianira-ui@1.27.0 and fluid-type-ui@2.0.8 resolving C2 locked-ioc-19 from an Ethereum wallet.
• 2026-09-30 End of the ESET reporting window (April-September 2026).
• 2026-10-28 ESET publishes the APT Activity Report Q2 2026-Q3 2026 noting Lazarus drone targeting and DeceptiveDevelopment's shift to supply-chain compromise.
• 2026-11-10 Cyber Security News publishes technical coverage and IOCs for the Lazarus and DeceptiveDevelopment campaigns.

Sources cited

• ESET APT Activity Report Q2 2026-Q3 2026 ESET WeLiveSecurity · Research · 2026-10-28
• ESET APT Activity Report Q2 2026-Q3 2026 (PDF) web-assets.esetstatic.com · Research · 2026-10-28
• Gotta fly: Lazarus targets the UAV sector (ESET Research) ESET WeLiveSecurity · Research · 2025-10-23
• ESET press release: North Korean Lazarus group targets the drone sector in Europe eset.com · Vendor report · 2025-10-23
• NullReceiver: DPRK C2 technique (OpenSourceMalware) opensourcemalware.com · Research · 2026-08-02
• Six npm Packages Use Ethereum Transactions to Retrieve Malicious Payloads (Sonatype) sonatype.com · Vendor report
• Inside DPRK's npm malware factory: 108 packages, 261 versions (Panther) panther.com · Blog
• North Korean Hackers Target Drone Technology and Software Supply Chains in New Cyberespionage Campaigns cybersecuritynews.com · News · 2026-11-10
• Trojanized npm packages decode C2 IP (The Hacker News) The Hacker News · News
• Oil shipments, drone makers, and a poisoned code library targeted in recent APT campaigns (Help Net Security) Help Net Security · News · 2026-05-28

More in apt

• CopperDragon Sparrow Framework: SilentDelivery, OceanGate and DarkWire Campaigns (China-nexus)
• North Korea-aligned Lazarus Targets Drone Sector (ScoringMathTea via BinMergeLoader) and DeceptiveDevelopment Targets Software Repositories (ESET APT Activity Report Q2-Q3 2026)
• Turla (Secret Blizzard) Cereal modular .NET toolset targets government Microsoft Exchange servers
• TraderTraitor (DPRK-aligned) FLATROOF and ROOFDECK macOS Backdoors Resurface on IT Services Victim With No Crypto Ties
• CRAFTY FALCON targets Indian fintechs via exposed APIs during weekends and low-monitoring periods

More from Lazarus Group

• The Mac Malware of 2023: macOS Ransomware, Stealers, and DPRK/Iran-Linked APT Malware (Objective-See Annual Review)
• North Korean Threat Actors Operationalize AI Across Tradecraft (Jade/Coral/Jasper/Diamond/Onyx/Pearl/Sapphire/Emerald Sleet; ProcmacSteal)
• NSFOCUS Monthly APT Insights August 2026: Lazarus MISTPEN/ForestTiger/RelayShell Campaign with CVE-2026-68820, UAC-0099 LUNCHPOKE/BURNYBEAR/MATCHBOIL.V2, CVE-2026-42897 Exchange OWA Exploitation
• Operation FlashHole: Lazarus watering-hole and spear-phishing campaign abusing INISAFE CrossWeb EX against South Korean organizations
• Weekly threat digest (week ending 2026-06-07): PAN-OS GlobalProtect CVE-2026-0257 exploitation, React2Shell CVE-2025-55182 abuse by APT-C-26, and npm/state-actor campaigns
• Bitget Exchange Loses ~$351.6M (On-Chain: ~$356.9M) in Suspected North Korean (TraderTraitor) Backend Compromise and Authorization-Flow Abuse