# North Korean Lazarus (Operation DreamJob) and DeceptiveDevelopment Target Drone Technology and Software Supply Chains

> ESET's APT Activity Report (Q2-Q3 2026, April-September 2026) describes North Korea-aligned Lazarus resuming Operation DreamJob recruitment lures against European defense and UAV-sector companies, while DeceptiveDevelopment moved from fake job interviews to poisoning open-source software supply chains (npm, Go, Packagist, PyPI, browser extension marketplaces) to steal developer credentials.

- **Published:** 2026-11-10T14:43:11Z
- **Last reviewed:** 2026-11-10T14:43:11Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5653
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5653.png
- **ID:** TL-2026-5653
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** Lazarus Group (North Korea)
- **Detections:** 9 (1 shown free below) · **IOCs:** 28 (3 shown free below)

## Description

Per ESET's APT Activity Report Q2 2026-Q3 2026 (published 28 October 2026) and coverage by Cyber Security News (10 November 2026), two North Korea-aligned clusters were active between April and September 2026.

Lazarus / Operation DreamJob resumed targeting the drone sector around June 2026, mainly European defense OEMs and unmanned aircraft system suppliers, using recruitment-themed social engineering. One Central European defense company received a password-protected ZIP containing a BAE Systems-themed job description PDF (with an incorrect header) plus a trojanized SumatraPDF viewer presented as necessary to open it. New tooling includes MortPusLoader (two trojanized Notepad++ plugins, replacing the earlier WinMerge-plugin loader BinMergeLoader), ScoringMathTea (aka ForestTiger) as the main payload, and LightlessTeaR, a rewrite of LightlessCan that implements common Windows commands internally rather than spawning command-line processes. Compromised Roundcube webmail servers at academic and government institutions in South America supported C2. ESET assesses the drone focus as likely motivated by the role of drones in the war in Ukraine and North Korea's drone manufacturing ambitions; this is an assessment, not proof of coordination with Russia. The earlier DreamJob UAV wave (ESET, 23 October 2025) used trojanized open-source projects (Notepad++/WinMerge plugins, MuPDF, TightVNC, libpcre, DirectX wrappers), DLL side-loading (webservices.dll, radcui.dll via wksprt.exe/wkspbroker.exe), in-memory loading with MemoryModule, AES-128/ChaCha20 staging, and ScoringMathTea (about 40 commands, IDEA-encrypted base64 C2 over HTTP/HTTPS to compromised WordPress sites).

DeceptiveDevelopment moved from fake job-interview lures to broad software supply-chain compromise: harvesting developer Git credentials, SSH keys and access tokens, then injecting malicious code into public and private repositories (often with rewritten commit history) and propagating through poisoned projects distributed via npm, the Go module mirror, Packagist, PyPI and browser extension marketplaces. Most compromised projects were small utilities maintained by individuals. Tooling includes NullReceiver, a blockchain-based C2 lookup loader that reads the most recent outgoing transaction of a hardcoded Ethereum wallet and decodes the C2 IP from the recipient address (so operators can rotate servers with another transaction); OmniStealer, a cross-platform Python infostealer targeting credentials, wallets, password managers and developer secrets; and DEV#POPPER RAT, whose updated versions inject code into VS Code, Cursor and Discord to run at application startup. A hidden VS Code task in a compromised repository can launch the lookup mechanism.

OpenSourceMalware's static analysis of the npm packages bianira-ui@1.27.0 and fluid-type-ui@2.0.8 (clones of Tailwind CSS plugins, attributed by that source to the DPRK Contagious Interview campaign) found the hardcoded wallet 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a, a zero-value transaction to the encoded recipient 0xa658863ea658863e68656c6c6f6970626f742121 decoding to 166.88.134.62 (trailing bytes 'helloipbot!!'), RPC lookups via 1rpc.io and eth.drpc.org, the marker A10-npm3!, and a Node.js RAT connecting to ports 443 and 80. Caveat: ESET stated it had not attributed DeceptiveDevelopment to a known actor, and linking NullReceiver specifically to ESET's DeceptiveDevelopment reporting is inferred from shared DPRK attribution and npm delivery. The public ESET summary contains no IOCs; the IOCs below come from the news article, OpenSourceMalware, and ESET's October 2025 DreamJob UAV research (lineage context).

## MITRE ATT&CK

- T1566.003 Phishing: Spearphishing via Service
- T1195.002 Supply Chain Compromise: Compromise Software Supply Chain
- T1204.002 User Execution: Malicious File
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1129 Shared Modules
- T1574.001 DLL
- T1584.004 Compromise Infrastructure: Server
- T1587.001 Develop Capabilities: Malware
- T1620 Reflective Code Loading
- T1140 Deobfuscate/Decode Files or Information
- T1027.007 Obfuscated Files or Information: Dynamic API Resolution
- T1552.004 Unsecured Credentials: Private Keys
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1528 Steal Application Access Token
- T1057 Process Discovery
- T1082 System Information Discovery
- T1071.001 Application Layer Protocol: Web Protocols
- T1568 Dynamic Resolution
- T1573.001 Encrypted Channel: Symmetric Cryptography

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**NullReceiver Blockchain C2 Lookup — Node.js Contacting Ethereum RPC or 166.88.134.62** (`TL-2026-5653-SPL-001`)

Detects the NullReceiver loader used by DPRK-linked (Lazarus / DeceptiveDevelopment) trojanized npm packages such as bianira-ui@1.27.0 and fluid-type-ui@2.0.8. The loader reads the latest outgoing transaction of a hardcoded Ethereum wallet (0xa322e5f3d311d3080e6f0121063e9adc2490ef1a) through public RPC endpoints (1rpc.io, eth.drpc.org) and decodes the C2 IP (166.88.134.62) from the recipient address. A Node.js/Bun/Deno process resolving those RPC hosts or connecting to the decoded C2 on ports 80/443 on a developer or build host is the behavioural signature of this supply-chain stage (T1195.002, T1568, T1059.007).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1195.002, T1568, T1059.007, T1071.001
- **Data sources:** sysmon, microsoft_defender_for_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
(EventCode=22 OR EventCode=3) Image IN ("*\\node.exe","*\\bun.exe","*\\deno.exe")
| where match(QueryName,"(?i)^(1rpc\\.io|eth\\.drpc\\.org)\\.?$") OR match(DestinationHostname,"(?i)^(1rpc\\.io|eth\\.drpc\\.org)\\.?$") OR DestinationIp="166.88.134.62"
| eval indicator=coalesce(QueryName, DestinationHostname, DestinationIp)
| stats count min(_time) as firstTime max(_time) as lastTime values(indicator) as indicators values(DestinationIp) as dest_ips values(DestinationPort) as dest_ports by host, User, Image
| eval firstTime=strftime(firstTime,"%Y-%m-%d %H:%M:%S"), lastTime=strftime(lastTime,"%Y-%m-%d %H:%M:%S")
| table firstTime lastTime host User Image indicators dest_ips dest_ports count
```

### Microsoft KQL

```kql
let EthRpcHosts = dynamic(["1rpc.io","eth.drpc.org"]);
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("node.exe","bun.exe","deno.exe","node","bun","deno")
| where RemoteIP == "166.88.134.62" or RemoteUrl has_any (EthRpcHosts)
| summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), Connections=count(), RemoteIPs=make_set(RemoteIP, 10), RemoteUrls=make_set(RemoteUrl, 10), Ports=make_set(RemotePort, 10) by DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine
```

### Sigma

```yaml
title: Node.js Process Contacting Ethereum RPC Endpoints (NullReceiver Blockchain C2 Lookup)
id: 7c1d2e3f-4a5b-4c6d-8e9f-565300000001
status: experimental
description: Detects Node.js, Bun or Deno resolving public Ethereum RPC hosts (1rpc.io, eth.drpc.org) as used by the DPRK-linked NullReceiver loader in trojanized npm packages (bianira-ui, fluid-type-ui) to decode its C2 address (166.88.134.62) from a hardcoded wallet.
references:
    - https://www.welivesecurity.com/en/eset-research/eset-apt-activity-report-q2-2026-q3-2026/
    - https://opensourcemalware.com/blog/nullreceiver-dprk-c2-technique
    - https://welivesecurity.com/en/eset-research/gotta-fly-lazarus-targets-uav-sector
author: Threadlinqs Team
date: 2026-11-10
tags:
    - attack.initial-access
    - attack.t1195.002
    - attack.command-and-control
    - attack.t1568
    - attack.execution
    - attack.t1059.007
logsource:
    category: dns_query
    product: windows
detection:
    selection_proc:
        Image|endswith:
            - '\node.exe'
            - '\bun.exe'
            - '\deno.exe'
    selection_rpc:
        QueryName|endswith:
            - '1rpc.io'
            - 'eth.drpc.org'
    condition: selection_proc and selection_rpc
falsepositives:
    - Legitimate Web3/dApp developers whose Node.js tooling queries public Ethereum RPC providers
    - Blockchain indexers or wallet backends running on Node.js
level: high
```

**Known false positives:**

- Web3 / dApp developers running Node.js tooling that legitimately queries Ethereum RPC providers such as 1rpc.io or eth.drpc.org
- Blockchain indexer or wallet backend services built on Node.js

**Tuning notes:** Exclude known Web3 development hosts and service accounts by host or User. Extend the Image list for npx or Electron wrappers if your telemetry reports a different image. Ensure Sysmon DNS logging (EventCode 22) includes Node.js. Add other RPC providers (infura, alchemy, cloudflare-eth) only for hosts that have no Web3 business need.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Malicious NullReceiver npm Packages bianira-ui / fluid-type-ui Installed or Executed (locked: unlock with TL Creds)
- DEV#POPPER Startup Injection — VS Code, Cursor or Discord Spawning Download/Exec Shells (locked: unlock with TL Creds)
- Community-Observed DPRK-Linked Sibling C2 Infrastructure (TL_OSINT_Scan) (locked: unlock with TL Creds)
- Trojanized SumatraPDF Launched From User-Writable Path (Operation DreamJob Lure) (locked: unlock with TL Creds)
- OmniStealer-Style Developer Secret Harvesting — Node/Python Reading Keys, Tokens and Browser Stores (locked: unlock with TL Creds)
- Known Lazarus DreamJob Loader and ScoringMathTea Hashes Loaded or Executed (locked: unlock with TL Creds)
- DreamJob DLL Side-Loading — wksprt/wkspbroker webservices.dll & radcui.dll or Unsigned Notepad++ Plugin (locked: unlock with TL Creds)
- ScoringMathTea and NullReceiver C2 Infrastructure — Connections to Known Lazarus/DPRK C2 Hosts (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 28)

Defanged, TLP:CLEAR.

- IP address: `166.88.134[.]62`
- Domain: `coralsunmarine[.]com`
- URL: `hxxps://1rpc[.]io/eth`

Full set of 28 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [North Korean Hackers Target Drone Technology and Software Supply Chains in New Cyberespionage Campaigns](https://cybersecuritynews.com/north-korean-hackers-3/)
- [ESET APT Activity Report Q2 2026-Q3 2026](https://www.welivesecurity.com/en/eset-research/eset-apt-activity-report-q2-2026-q3-2026/)
- [ESET APT Activity Report Q2 2026-Q3 2026 (PDF)](https://web-assets.esetstatic.com/wls/en/papers/threat-reports/eset-apt-activity-report-q2-2026-q3-2026.pdf)
- [Gotta fly: Lazarus targets the UAV sector (ESET Research)](https://welivesecurity.com/en/eset-research/gotta-fly-lazarus-targets-uav-sector)
- [ESET press release: North Korean Lazarus group targets the drone sector in Europe](https://www.eset.com/us/about/newsroom/research/north-korean-lazarus-group-targets-drone-sector-europe/)
- [NullReceiver: DPRK C2 technique (OpenSourceMalware)](https://opensourcemalware.com/blog/nullreceiver-dprk-c2-technique)
- [Six npm Packages Use Ethereum Transactions to Retrieve Malicious Payloads (Sonatype)](https://www.sonatype.com/blog/six-npm-packages-use-ethereum-transactions-to-retrieve-malicious-payloads)
- [Trojanized npm packages decode C2 IP (The Hacker News)](https://thehackernews.com/2026/08/trojanized-npm-packages-decode-c2-ip.html)
- [Inside DPRK's npm malware factory: 108 packages, 261 versions (Panther)](https://panther.com/blog/inside-dprk's-npm-malware-factory-108-packages-261-versions-and-a-31-day-campaign-wave)
- [Oil shipments, drone makers, and a poisoned code library targeted in recent APT campaigns (Help Net Security)](https://www.helpnetsecurity.com/2026/05/28/eset-apt-activity-report/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5653