Operation Dreamjob

Operation DreamJob is a campaign attributed to the Lazarus group, a North Korea-aligned group infamous for its cyberespionage and financial theft activities. The campaign was first coined in a blog post by ClearSky in August 2020, where it described Lazarus' attempts to target defense and aerospace companies for cyberespionage purposes. The campaign involves reaching out to potential targets through LinkedIn, posing as recruiters from industry leaders, and luring them with attractive job offers. This method of operation underscores that the Lazarus group's objectives are not solely financial but also include espionage goals. ESET researchers discovered a new Lazarus Operation DreamJob campaign targeting Linux users. The Linux component of this campaign was named SimplexTea, which is used to compromise unsuspecting victims who fall for the fake job offers. This discovery corroborates the theory that the Lazarus group was behind the 3CX supply-chain attack, as similarities were found with the newly discovered Linux malware used in Operation DreamJob. The Lazarus actor would typically pretend to be a recruiter from Meta (formerly Facebook), named Steve Dawson, to initiate the attack. The Operation DreamJob campaign has been linked with high confidence to several attacks, including one in Spain. The campaign has also been known under other names such as DeathNote or NukeSped. Security vendors like ESET have been actively tracking the campaign, providing valuable insights into the Lazarus group's tactics. With this information now public, companies are better equipped to identify compromises and contain incidents related to this campaign.