NORTH KOREAN HACKING GROUP TARGETS EUROPEAN DRONE MAKERS WITH SCORINGMATHTEA MALWARE

North Korea’s Lazarus Group has launched a new wave of cyber-espionage operations targeting European drone manufacturers and defense firms involved in supplying unmanned aerial vehicles (UAVs) to Ukraine.
The campaign, which security researchers link to the long-running Operation DreamJob, uses sophisticated phishing lures disguised as recruitment offers from major aerospace companies to infiltrate sensitive military production networks.

Cyber analysts at ESET identified the malware strain ScoringMathTea as the group’s primary tool in the campaign. Once installed, the malware provides full system access, allowing attackers to exfiltrate proprietary drone schematics, manufacturing data, and operational control software critical to Europe’s defense supply chain.

---

INTELLIGENCE TARGETING ACROSS THE DRONE SECTOR

ESET’s threat research team confirmed that at least three European defense contractors — each responsible for manufacturing advanced UAV systems — were directly targeted between May and August 2025. One of the compromised entities reportedly produces two drone models currently deployed in Ukraine, suggesting Lazarus’ intent to reverse-engineer or enhance its own battlefield drone capabilities.

According to ESET analyst Alexis Rapin, one of the companies attacked also plays a key role in the supply chain for single-rotor UAVs, a class of aircraft North Korea has been developing domestically. The timing aligns with reports of North Korean troops appearing on the front lines in Russia’s Kursk region, where captured communications revealed their use of reconnaissance drones to coordinate artillery fire with Russian forces.

The overlap between cyber-theft and battlefield application underscores a broader pattern: Pyongyang’s digital operations directly fuel its kinetic warfare and foreign military support.

---

OPERATION DREAMJOB — AN OLD CAMPAIGN WITH NEW TARGETS

The Operation DreamJob campaign, active since 2020, relies on social engineering through fake job offers sent via spear-phishing emails.
In this latest wave, Lazarus operatives posed as recruiters from aerospace firms, including those tied to Western defense alliances. The emails carried PDF attachments containing embedded ScoringMathTea payloads, masked as job descriptions for high-profile engineering positions.

Once opened, the malware establishes persistence, enumerates system architecture, and exfiltrates sensitive data, while using encrypted Telegram-based command channels to maintain contact with Lazarus-controlled servers.

ESET traced the malware’s lineage back to October 2022, when ScoringMathTea was deployed in similar recruitment-themed attacks against organizations in Portugal, Germany, India, Poland, and Italy. The group’s continued use of identical tactics — coupled with customized payloads — demonstrates its operational consistency and discipline.

“Lazarus has maintained a consistent modus operandi, deploying its preferred main payload, ScoringMathTea, and using similar methods to trojanize open-source applications,” said ESET researcher Peter Kálnai, who led the investigation.

---

STRATEGIC IMPLICATIONS — CYBER WARFARE AND MILITARY SUPPLY LINES

The campaign’s targeting of drone manufacturers is no coincidence. Drones have become one of the most valuable assets in the Russia–Ukraine conflict, and by extension, a point of intense global espionage.
For North Korea, access to European UAV schematics and flight-control technology would represent a major leap forward — enabling both reverse engineering and export-based replication for its own military-industrial complex.

This operation also signals an expanding cooperation pattern between Pyongyang and Moscow. While Russia supplies physical battleground access and resources, North Korea contributes cyber capabilities and potentially low-cost military labor — a hybrid alliance that merges physical warfare with digital infiltration.

ESET’s findings coincide with intelligence that North Korean operatives are actively attempting to integrate captured or stolen Western drone technologies into their domestic weapons programs.

---

SCORINGMATHTEA — THE ESPIONAGE CORE

ScoringMathTea acts as a modular surveillance implant designed to collect network intelligence, user credentials, and internal documentation before opening a channel for further payload deployment.
The malware’s evolution shows Lazarus’ continued preference for customized payload loaders that disguise themselves within job-related applications or legitimate utilities, allowing long-term persistence within sensitive environments.

By combining social engineering precision with encrypted C2 (command-and-control) communications, ScoringMathTea enables Lazarus to maintain stealth even against updated EDR and intrusion detection systems.
The group’s operational sophistication reinforces why it remains one of the most difficult threat actors to fully neutralize.

---

TRJ VERDICT

The Lazarus Group’s renewed focus on European drone manufacturers confirms what many in the cybersecurity world already understand: digital warfare is now industrial warfare.

These aren’t random phishing campaigns — they are targeted state-aligned espionage operations built to erode the technological edge of Western defense contractors.
Each stolen schematic, each compromised UAV control module, represents more than data — it’s a transfer of battlefield advantage.

The deeper reality is that North Korea’s cyber program no longer operates in isolation; it’s now embedded within a global conflict network, moving intelligence from inbox to battlefield in real time.

Every stolen design is a future weapon. Every ignored email could be a breach in national defense.

---

---

---

---

---

---

---