A convincing job offer can be more than a recruitment opportunity. For employees in defense, aerospace and technology companies, it can become the first step in a targeted cyberattack.

Who Are the Lazarus Group?

The Lazarus Group is a North Korea-linked cyber threat group associated with the country’s Reconnaissance General Bureau. It has conducted cyber-espionage, destructive attacks and financially motivated operations. MITRE tracks Lazarus as active since at least 2009.

How Was Lazarus Group Identified?

Lazarus was identified gradually as researchers connected separate attacks through malware, infrastructure, techniques and coding similarities. Its earliest commonly linked activity dates to 2009, including attacks later associated with Operation Troy, which targeted websites in South Korea and the United States. The 2014 Sony Pictures attack became a major turning point, helping researchers and authorities connect Lazarus to a broader pattern of North Korean cyber activity.

The Recruitment Message That Became an Attack Vector

Operation Dream Job is not a conventional phishing campaign in which an attacker simply sends thousands of generic emails. The strength of the operation has been its ability to make the approach look relevant to the victim.

MITRE says Lazarus conducted reconnaissance on potential targets and used LinkedIn to identify employees within selected organizations. Attackers then tailored job vacancy announcements to specific individuals and impersonated HR or recruitment personnel.

The approach can involve:

• Fake recruiter profiles
• Attractive employment opportunities
• Tailored job descriptions
• Interviews conducted through messaging platforms
• Malicious documents or links presented as recruitment material
• Malware delivered after the victim engages with the supposed opportunity

The social-engineering element is crucial. Instead of asking a victim to open an obviously suspicious attachment, the attacker gives them a reason to believe the file or link is necessary for their career.

How does Operation Dream Job target job seekers

The campaign begins with information gathering. Attackers can study professional profiles, employment history, technical skills and organizational roles before approaching a target.

That allows a fake recruiter to create a much more convincing conversation.

For example, someone working in aerospace engineering may receive a vacancy that appears connected to their specialist experience. A developer may be offered a coding assessment. A defense employee may be approached about a position requiring similar security or engineering expertise.

MITRE's records show that Lazarus used social engineering, impersonation and malicious files as part of Operation Dream Job.

This is why the campaign is particularly relevant to employees who routinely use professional networking platforms.

A Fake LinkedIn Recruiter Can Be the First Warning Sign

The phrase Lazarus Group fake LinkedIn recruiter scam describes one of the campaign's most recognizable techniques.

The attackers have used fake LinkedIn accounts to identify and approach potential victims. MITRE specifically documents the creation of fake LinkedIn accounts for Operation Dream Job and the use of impersonated hiring personnel.

The danger is not the LinkedIn message itself. The risk comes when the conversation moves toward an action that gives the attacker access to the victim's computer.

Security teams should therefore pay attention to unusual recruitment activity involving:

• Unexpected interview invitations
• Job offers from unfamiliar recruiters
• Requests to download software
• Recruitment documents from unknown domains
• Requests to run an executable or script
• Coding tests that require unusual system permissions

A legitimate recruitment process should not normally require a candidate to disable security protections or execute unexplained software.

The Windows Zero-Day Element

The technical side of Lazarus operations has also evolved.

Lazarus has previously exploited Windows vulnerabilities to obtain deeper access to compromised systems. In 2024, researchers documented the exploitation of a Windows AppLocker driver vulnerability, CVE-2024-21338, to obtain kernel-level capabilities and deploy the FudModule rootkit. The vulnerability was subsequently patched by Microsoft.

Researchers later documented another Lazarus-linked Windows zero-day involving the AFD.sys driver. The exploitation allowed attackers to elevate privileges and use the FudModule rootkit to interfere with security protections.

That history provides important context for reports about a zero-day vulnerability in Microsoft Windows being used in newer Lazarus activity.

A zero-day is particularly dangerous because defenders may have little or no warning before a vendor releases a patch. Once attackers obtain initial access, a privilege-escalation flaw can potentially help them move from a limited foothold to much greater control of the machine.

From Initial Access to a Lazarus Group Backdoor

The ultimate objective is not necessarily to compromise one computer and stop there.

A Lazarus Group backdoor can provide attackers with continued access, allowing them to gather information, examine the victim's environment and potentially move deeper into an organization.

MITRE documents several techniques associated with Operation Dream Job, including PowerShell, Windows command shell activity, malicious DLLs, data discovery and communication with attacker-controlled infrastructure.

In other words, the fake job offer can be only the beginning.

Once inside a corporate environment, attackers may seek:

• Sensitive documents
• Employee information
• Technical research
• Credentials
• Network information
• Financial information
• Data connected to defense or aerospace projects

Lazarus Group Defense and Aerospace Targeting

Defense and aerospace companies are attractive targets because their systems can contain valuable technical information, intellectual property and information relevant to national security.

MITRE identifies Operation Dream Job as a cyber-espionage campaign targeting defense, aerospace, government and other sectors in several countries, including the United States, Israel, Australia, Russia and India.

The historical record also shows that European aerospace and military companies were targeted through related Lazarus activity.

That makes searches such as Lazarus Group defense aerospace hack France Germany relevant to understanding the wider threat landscape, although individual country claims should be attributed only when supported by a specific incident report.

What companies were targeted by Operation Dream Job

Operation Dream Job has not been limited to one company or one country. MITRE describes targeting across defense, aerospace, government and other sectors.

The campaign has been associated with organizations and individuals in:

• United States
• India
• Israel
• Australia
• Russia
• European aerospace and military sectors

The precise list of victims is often difficult to establish because organizations may not publicly disclose attempted intrusions or successful compromises. MITRE therefore provides a more reliable picture of the campaign's sectors and geographic scope than unverified lists circulating online.

Why the Campaign Is Difficult to Stop

The strength of Operation Dream Job comes from combining human trust with technical exploitation.

A security system can detect a malicious file, but it cannot always determine whether a person genuinely believes that file is part of a legitimate interview.

That creates a two-layer problem:

Social engineering convinces the victim to interact with the attacker.

Malware and exploitation turn that interaction into technical access.

This combination makes employee awareness just as important as endpoint protection.

It also explains why defense organizations remain attractive targets. An employee may have access to information that is valuable even when that employee is not a senior executive or system administrator.

How Organizations Can Reduce the Risk

Companies cannot rely on employees simply recognizing every fake recruiter. The better approach is to combine awareness training with technical controls.

Organizations should:

• Verify recruiters through independent channels.
• Avoid running recruitment software from unknown websites.
• Treat unexpected coding assignments as potentially risky.
• Keep Windows and security software fully patched.
• Use endpoint detection and response systems.
• Restrict unnecessary administrative privileges.
• Monitor unusual PowerShell and command-shell activity.
• Investigate unexpected downloads from recruitment conversations.
• Separate sensitive corporate systems from ordinary employee workstations.
• The lesson from Lazarus activity is straightforward: a trusted conversation can become a technical attack path.

Conclusion

The Lazarus Group has demonstrated that cyber-espionage does not always begin with an obviously malicious email. Operation Dream Job shows how attackers can use professional identities, fake recruiters and realistic employment opportunities to establish trust before attempting to compromise a target.

The group's history with Windows exploitation makes the threat more serious. Previous campaigns have shown Lazarus using Windows vulnerabilities and sophisticated rootkits to gain deeper access and evade security controls.

For defense and aerospace companies, the message is clear. Recruitment platforms are not outside the cybersecurity perimeter. A job application, interview document or coding assessment can become an entry point into a much larger espionage operation.