Operation Dream Job — When Job Offers Become Espionage

A long‑running North Korea‑linked campaign (Operation Dream Job) is using fake recruitment lures to compromise defense and aerospace suppliers across Europe, stealing drone‑related IP and manufacturing know‑how via payloads such as ScoringMathTea and MISTPEN. The attack is social‑engineering first, technically sophisticated second, and aimed at long‑term data collection and intellectual property exfiltration.

What happened (concise timeline and tradecraft)

Adversaries posed as recruiters and sent convincing job offers and decoy documents to engineers and contractors.
Victims open a trojanized PDF reader or installer, which executes a dropper that sideloads malicious DLLs.
Initial loaders deploy advanced RATs (ScoringMathTea) and modular downloaders (BinMergeLoader) that use legitimate services (Microsoft Graph API and tokens) to fetch follow‑on payloads.
Targets include telecoms, UAV component manufacturers, government departments, and a U.S. university—consistent with espionage for drone programs and defense manufacturing.

Why this matters to a broad audience

Strategic risk: Industrial espionage focused on UAVs and aerospace directly affects national security, supply chains, and competitive advantage for companies and countries.
Human vector: Social engineering via fake jobs preys on legitimate career mobility and professional curiosity—everyone who hires, interviews, or shares documentation is at risk.
Persistence and stealth: These groups aim to remain undetected for long periods to harvest credentials, blueprints, and operational know‑how, enabling downstream misuse or resale.
Operational impact: A single compromised engineer or supplier can expose CI/CD keys, CAD files, test plans, vendor credentials, and procurement information with cascading consequences.

Practical actions for organisations and individuals

For leadership and boards

Treat recruitment and talent channels as part of your attack surface; fund security controls and incident readiness for supplier and HR vectors.
Require supplier security attestations and include cyber clauses in contracts with defence‑adjacent vendors.

For security and IT teams

Enforce strict execution controls: block unsigned installers, restrict DLL sideloading, and monitor uncommon use of developer tools.
Hunt for post‑exploitation indicators: unusual Microsoft Graph API calls, anomalous token use, new service principals, and unexplained scheduled tasks.
Isolate and harden engineering workstations: network segmentation, least privilege, and ephemeral build agents that don’t hold persistent secrets.
Protect the supply chain: sign and verify artifacts, require secure code review for third‑party tools, and ban installation of unvetted dev utilities on build hosts.
Run phishing and job‑offer simulations focused on recruitment lures; include HR in tabletop exercises and incident playbooks.

For individuals and engineers

Validate recruiters and roles independently; vet offers through corporate HR channels before interacting with attachments or custom tools.
Never install developer tools or custom PDF readers sent by unknown contacts; request sanitized copies through corporate channels.
Rotate and compartmentalise credentials; avoid using work accounts for third‑party services without approval.

One‑minute incident triage checklist

If suspicious job offer attachments were opened, isolate the endpoint and capture memory and disk images.
Revoke any tokens or OAuth clients created recently and rotate service credentials used by the affected host.
Search logs for Graph API activity, new application registrations, and suspicious outbound connections to cloud storage or C2 domains.
Quarantine build systems and run integrity checks on recent artifacts.
Notify legal and regulators if sensitive defense or controlled technical information may have been exposed.

Thinking points

“A job offer that asks you to run an installer is not a career opportunity—it’s an attack. Validate before you install.”
“Recruitment is now a cyber‑attack vector. HR, legal and security must be in the same room for tabletop exercises.”
“One compromised engineer can hand attackers the keys to an entire supply chain—segmentation and ephemeral build agents matter.”