The Lazarus Group, a North Korean-linked hacking organization, has reportedly resumed cyber espionage activities targeting the European drone industry around June of this year. They have approached employees of defense companies with fake job offers.
According to a report by the cybersecurity firm ESET, based in Europe, cited by Voice of America on November 12, the group's actions may aim to acquire drone technology and manufacturing knowledge that have gained importance due to the Ukraine war, thereby enhancing North Korea's domestic production capabilities.
The report details an incident involving a European defense company where an employee received a password-protected compressed file. This file contained a PDF disguised as a recruitment document from the global defense giant BAE Systems, along with a malicious document viewer program. The PDF was designed to be unreadable by standard programs, prompting the employee to run the accompanying program to check the job conditions. ESET explained that this program was designed to display a fake job document while executing malware.
ESET noted, "As new operational tactics and technologies for drones are being developed and tested, securing related knowledge and manufacturing processes could assist North Korea in developing its own drone production capabilities." They emphasized that not only finished product manufacturers but also key suppliers have been targeted, indicating that the technology and production processes involved in drones are also part of North Korea's information-gathering objectives. However, the report did not specify which technical materials were leaked. ESET also highlighted that both South Korea and Ukraine have emerged as primary targets for North Korean-linked hacking groups, suggesting that North Korea's increased military support to Russia and strengthened ties with Moscow may have influenced this shift.
This is not the first time Lazarus has shown interest in the drone sector. After ESET published an analysis of North Korean activities last year, the group reportedly went silent for a time before resuming its activities around June of this year.
* This article has been translated by AI.
Copyright ⓒ Aju Press All rights reserved.