DreamJob

"DreamJob" is a highly sophisticated and lucrative campaign led by the infamous Lazarus Group, a North Korea-aligned cybercriminal entity. The operation, first identified in a blog post by ClearSky in August 2020, targets defense and aerospace companies with an objective of cyberespionage. The group uses social engineering tactics, specifically deploying fake job offers as lures to compromise its targets. In the past, these attacks have resulted in significant financial gains for the group, including the theft of $620 million from Axie Infinity. Recently, ESET researchers have discovered a new Lazarus Operation DreamJob campaign targeting Linux users, marking the first time this demographic has been targeted in such a campaign. This new campaign, dubbed "Operation DreamJob with a Linux payload," uses an HSBC-themed lure and a Linux component named SimplexTea. The attack typically starts with a LinkedIn message from a Lazarus actor pretending to be a recruiter from Meta (formerly Facebook), named Steve Dawson. The payload is likely distributed through spearphishing or direct messages on LinkedIn. The Lazarus Group's activities are not solely financially motivated. The recent discovery underscores that the group's campaigns also encompass espionage objectives. This was evident in the group's attack in Spain, which security experts attribute to Operation DreamJob with a high level of confidence. Similarities with newly discovered Linux malware used in Operation DreamJob corroborate the theory that the Lazarus Group was behind the 3CX supply-chain attack.