Dream-Job-Campaign.pdf

Operation 'Dream Job' — ClearSky details a widespread Lazarus (North Korea) espionage campaign that lures defense/aerospace employees with tailored fake recruiter profiles and job offers delivered via LinkedIn and WhatsApp; victims are induced to download archives that deploy malicious PDFs (opened with an attacker-modified Sumatra reader), DOC/DOTM macros, LNK shortcuts and DLL droppers that install a RAT (DRATzarus) and additional tools for reconnaissance and possible financial fraud. The report includes technical analysis, MITRE ATT&CK mappings, extensive IOCs (hashes, compromised domains), attribution evidence and recommendations for social-engineering and endpoint mitigations.