North Korean threat actors have escalated their espionage efforts from April through September 2026, focusing sharply on drone technology and vulnerable software developers. Two main hacking groups—Lazarus and DeceptiveDevelopment—are behind recent campaigns that combine recruitment ploys with supply chain infiltration.
Drone Sector in Lazarus’ Crosshairs
During summer 2026, Lazarus resumed “Operation DreamJob,” targeting European defense firms deep in the unmanned aerial systems domain. Original equipment manufacturers and key suppliers—especially those involved with drone tech—found themselves in Lazarus’ sights. The group restarts after a lull following attacks documented in late 2025.
An example: in one case, an employee at a Central European defense contractor was sent a ZIP file posing as a job offer from a defense giant. The ZIP included a sham SumatraPDF viewer trojanized to drop malware and trigger the payload—echoing earlier job-themed phishing trends. The attackers also switched tactics, replacing spoofed WinMerge plugins with malicious Notepad++ add-ons called MortPusLoader. These deliver either ScoringMathTea (aka ForestTiger) or a newer version of LightlessCan known as LightlessTeaR.
DeceptiveDevelopment Infects Code for Wider Reach
Meanwhile, DeceptiveDevelopment has been stealing Git credentials, SSH keys, and access tokens—typically after convincing developers to complete bogus recruitment tasks. Once inside, they inject malicious code into both public and private repos across npm, PyPI, Go mirrors, Packagist, and browser extension stores. Many of these libraries are modest, community-maintained utilities, but the risk multiplies downstream.
To hide their tracks, they rewrite commit histories. One new trick involves a blockchain-based command server discovery method dubbed NullReceiver: the malware reads the latest Ethereum transaction from a hardcoded wallet address and pulls the recipient address to get the C2 server. That endpoint can be changed simply via another blockchain transaction—no need to patch each compromised package.
Payloads are varied: there’s OmniStealer, a cross-platform Python tool harvesting credentials, crypto wallets, password managers, and secrets; and DEV#POPPER RAT, which hooks into apps like VS Code, Cursor, and Discord to trigger when they launch.
Why It Matters
These renewed campaigns underscore how job-offer scams have evolved into complex operations that marry social engineering with code-level sabotage. United by deception, both Lazarus and DeceptiveDevelopment show how major engineering and manufacturing sectors—especially in defense—are now severely exposed.
Organizations using widely distributed tools—npm packages, browser extensions, even code editors—are at risk not simply from direct targets but from the ripple effect through dependency chains. Once a small open-source repo or utility gets compromised, every downstream user becomes vulnerable, often without realizing it.
For defenders, indicators of compromise include specific malware families like MortPusLoader, LightlessTeaR, OmniStealer, DEV#POPPER RAT, and infrastructures such as the NullReceiver Ethereum-wallet lookup mechanism. Monitoring developer credentials and build systems has become essential.
Signs of Compromise
- Npm packages like
[email protected]and[email protected]loaded via NullReceiver. - Ethereum wallet
0xa322e5f3d311d3080e6f0121063e9adc2490ef1ahardcoded for server discovery, and encoded recipients revealing malicious endpoints. - Command-and-control servers including
166.88.134.62:443and166.88.134.62:80among others. - Malware signatures such as the loader string
A10-npm3!.
These tools pose grave risks—especially for organizations relying on open-source ecosystems, shared codebases, or developers using default tools without proper vetting.
What to Watch: Be aware of unsolicited job offers, especially those involving software or document review tasks. Ensure code signing, vet plugins, and implement dependency auditing. Blockchain-linked domains like NullReceiver show how attackers are adapting rapidly.
With supply chain and drone tech now joined in North Korea’s cyberespionage toolbelt, every software dependency, every plugin, and every developer is suddenly a potential attack surface. How those vulnerabilities are managed may well decide who stays ahead.
Analysis: These evolving campaigns mark a shift in North Korea’s tactics. No longer mere probes or isolated breaches, they’re now carefully engineered efforts to embed themselves deep within supply chains. What seemed like classic espionage has mutated into stealthy persistence and automated propagation. For defenders—especially in defense contracting and open-source communities—priority one is closing the human-in-the-loop attack vector and hardening software tooling and credential hygiene. That’s where the real battlefield lies.
