The message looked like any other recruiter approach a defense engineer in Central Europe receives. It offered a role at BAE Systems, with the job description inside a password-protected ZIP archive. The PDF in the archive carried a deliberately broken header, so an ordinary reader would not open it. The archive conveniently included a viewer able to open it. When the engineer launched the trojanized SumatraPDF, a job description appeared on screen. Behind it, a trojanized Notepad++ plugin loaded ScoringMathTea, the remote access trojan at the core of North Korea's Operation DreamJob.
Elsewhere, developers maintaining small open-source utilities sat down for what looked like technical interviews. The coding challenges ran on their machines and harvested Git credentials, SSH keys, and access tokens. With those secrets in hand, North Korean threat actors pushed malicious code into the developers' own packages and rewrote commit history to hide the change. Users installing the poisoned versions could inherit the compromise without ever encountering the original recruiter.
Both patterns come from ESET's APT Activity Report covering April to September 2026, published October 28. One door leads into the companies building Europe's drones. The other leads into the open-source code European companies build with. North Korea is working both, and the geopolitics behind them is stranger than the headlines suggest.
Recruiters at the Door of Europe's Drone Makers
Operation DreamJob has used fake job offers against aerospace and defense firms for more than five years, including a 2023 intrusion at a Spanish aerospace company delivered through a fake Meta recruiter on LinkedIn. In October 2025, ESET documented a wave targeting three European defense companies. The victims were a metal engineering firm in Southeastern Europe, an aircraft component manufacturer in Central Europe, and a Central European defense company. One dropper carried the internal library name DroneEXEHijackingLoader.dll, pointing ESET toward the unmanned aerial systems sector.
One targeted company produces at least two drone models in service in Ukraine. It also sits in the supply chain for advanced single-rotor drones, a class of aircraft North Korea has not yet demonstrated an ability to militarize. ESET assessed the campaign was likely aimed at stealing proprietary information and manufacturing know-how. North Korea's Saetbyol-4 reconnaissance drone closely resembles Northrop Grumman's RQ-4 Global Hawk, and its Saetbyol-9 strike drone resembles General Atomics' MQ-9 Reaper. Pyongyang has drawn heavily on Western drone designs before.
On August 11, 2026, Check Point documented another wave in research on a Windows zero-day. The flaw, CVE-2026-68820, is a use-after-free vulnerability in the AFD.sys driver. LABYRINTH CHOLLIMA (aka Lazarus) exploited it to load a new version of its FudModule kernel rootkit and impair endpoint detection. Check Point found a heavy focus on defense firms building surveillance sensors, drones, and robotics. Activity reached Brazil, France, Germany, and India. One compromised French organization became the launch point for spear-phishing against others.
The campaign also wrapped its key exchange in post-quantum ML-KEM encryption, as I examined in my analysis of North Korean malware adopting post-quantum cryptography. Defenders recording the command-and-control traffic today cannot count on decrypting it later, even with a quantum computer.
ESET's latest reporting adds the BAE Systems lure and a retooled arsenal. Trojanized Notepad++ plugins ESET named MortPusLoader replaced the trojanized WinMerge plugins it called BinMergeLoader. The payload is either ScoringMathTea (aka ForestTiger) or LightlessTeaR, a rewrite of the earlier LightlessCan. LightlessTeaR executes common Windows commands internally rather than launching them through the command line, leaving defenders who monitor process creation with less to see. Command-and-control traffic runs through compromised Roundcube webmail servers at academic and government institutions in South America.
ESET says the victims are mostly European defense companies working as original equipment manufacturers or top-tier suppliers in the drone supply chain. I assess with high confidence North Korea's Operation DreamJob activity has repeatedly targeted Europe's unmanned systems industry since March 2025. The targeting spans separate periods, malware changes, and public exposure. I assess with moderate confidence European drone manufacturers have become an established intelligence collection priority.
European drone startups raised US$4.7 billion across 40 rounds in 2026, according to Dealroom's October 5 report, part of a record US$7.4 billion invested in European defense technology. Companies growing at this rate need engineers, manufacturing specialists, and software developers. They recruit internationally and routinely exchange technical documents with unfamiliar people. A fraudulent recruitment approach works against an industry where an unsolicited job offer is an ordinary part of professional life.
Why Steal What Russia Is Already Teaching?
Pyongyang already gains access to Russian drone manufacturing expertise through its expanding military and industrial relationship with Moscow, so the espionage motive needs a harder look. Ukrainian defense intelligence estimated planned recruitment of up to 12,000 North Korean workers and technicians for Russia's Alabuga complex in Tatarstan, according to reporting on CSIS research. Alabuga can reportedly produce more than 5,500 Geran drones a month, Russia's upgraded version of the Iranian Shahed.
CSIS expects North Korean technicians to return home with experience from a mass-production line. The Multilateral Sanctions Monitoring Team, formed by eleven states after Russia vetoed the mandate of the UN sanctions panel, estimated 15,000 to 30,000 North Korean workers were in Russia at the end of 2025.
The arrangement also generates revenue. CSIS reports Pyongyang retains an estimated 70 to 90 percent of overseas workers' wages. Moscow receives labor for its war industry while Pyongyang receives hard currency. The same arrangement serves military development and sanctions evasion.
So why phish engineers in Germany and France? Five hypotheses fit the evidence, and none excludes the others.
Hypothesis 1, Capabilities Russia Will Not Provide
Alabuga offers experience producing one-way attack drones at scale. European firms build reconnaissance platforms, surveillance sensors, single-rotor aircraft, and navigation systems designed to survive electronic warfare over Ukraine. North Korea lacks demonstrated capabilities in several of these areas, while Moscow has little reason to share every advanced design it possesses. ESET's single-rotor finding fits this hypothesis closely. I assess with moderate confidence acquiring capabilities unavailable through Russian assistance is a primary driver.
Hypothesis 2, Knowing the Equipment on the Other Side
North Korean soldiers fought alongside Russian forces in Kursk after Ukraine's 2024 incursion. The Lead Inspector General's Operation Atlantic Resolve quarterly report cites Defense Intelligence Agency reporting of at least 8,000 North Korean troops engaged in combat operations there as of March 2025.
Western-built drones operate across the battlefield, and ESET noted in 2025 the targeted firms manufacture equipment deployed in Ukraine. Knowing how those systems work, and how they fail, could benefit North Korean units and their Russian partners. I assess with low confidence this was a separate collection objective because the reporting identifies no specific tasking to acquire countermeasure information.
Hypothesis 3, Intelligence as Currency
Pyongyang could provide Moscow with intelligence in exchange for technology, oil, and diplomatic support. European defense suppliers would make valuable collection targets for either government. The hypothesis is attractive but weakly supported. ESET found overlapping interests without clear evidence of coordinated North Korean operations serving Russian objectives. Its findings concerning Belarus-aligned threat actors, discussed below, point more directly toward Moscow's cyber partners. I hold intelligence exchange as an objective of these campaigns at low confidence.
Hypothesis 4, A Product to Sell
ESET cited reports in 2025 of North Korea developing low-cost attack drones for export to African or Middle Eastern buyers. Stolen European designs and manufacturing processes could improve products Pyongyang hopes to sell outside the sanctions system. Revenue runs through much of North Korea's international activity, from the US$3 billion still sitting in wallets tied to the Binance theft to the developer compromises described below. The commercial incentive fits Pyongyang's established behavior, although no reporting names a prospective buyer.
Hypothesis 5, Checking the Ally.
Russian assistance creates an intelligence dependency Pyongyang has reason to examine independently. North Korean technicians can observe production methods at Alabuga without gaining access to every Russian design, electronic warfare capability, or manufacturing constraint. European technical intelligence could help validate Moscow's claims, identify capabilities Russia has withheld, and expose weaknesses obscured by selective transfers. Such collection would improve Pyongyang's negotiating position within an unequal military partnership. I hold this at low confidence as a specific objective of Operation DreamJob.
Allies Who Watch Each Other
North Korea's expanding military cooperation with Moscow led many analysts to expect North Korean cyber activity to serve Russian objectives in Ukraine. ESET found overlap around drones, but its telemetry "more clearly points to Belarus-aligned groups acting as cyberproxies" for Russia. ESET also documented the first destructive cyber attack by a Belarus-aligned threat actor it had observed in the European theater. FrostyNeighbor attacked a Ukrainian manufacturer important to the country's transportation sector.
North Korea's own Ukraine targeting is real but serves identifiable Pyongyang interests. Ukraine was the second most targeted country for North Korea-aligned activity during the period, after South Korea. ESET links the targeting to North Korea's growing involvement in Russia's war, extending beyond munitions and troops to specialized capabilities including drone operations. VELVET CHOLLIMA (aka Kimsuky), a North Korean espionage threat actor, used a drone-themed decoy document during the same period.
RICOCHET CHOLLIMA (aka ScarCruft) supplies the strangest finding. ESET found the threat actor deploying a worm named BlankOverride, which spreads through removable drives and carries the BLUELIGHT backdoor. The targets were entities tied to port infrastructure in an unnamed African country hosting a North Korean embassy and maintaining longstanding relations with Pyongyang.
ESET identified two possible objectives. RICOCHET CHOLLIMA may have been monitoring North Korean workers in the country, or collecting intelligence on Russia's expanding security presence around its ports. ESET cites the timing of Russian activity and earlier North Korean targeting of Russian maritime interests as reasons to consider the second possibility. Neither explanation requires treating Moscow and Pyongyang as adversaries. North Korea has reasons to monitor its overseas workers and independent reasons to understand what its Russian partner is doing.
Pyongyang and Moscow cooperate where their interests align, but neither has surrendered its independent intelligence requirements. Allies collecting on Moscow is not unique to Pyongyang, as Silent Lynx's espionage against Russia and its own partners showed. A partnership supplying troops, workers, and munitions has not produced the cyber coordination many analysts predicted. Western planning built around a unified geopolitical bloc risks mistaking overlapping collection priorities for shared operational control.
European counter-intelligence services should consider Russian and North Korean collection against the same targets without assuming the resulting intelligence is exchanged. Russia's GRU already hunts Europe's defense industrial base on its own account, as FANCY BEAR's two months inside a NATO naval shipbuilder demonstrated. A drone manufacturer can host both adversaries at once, each collecting for a different capital.
Poisoning the European Code
The second door opens through software development. FAMOUS CHOLLIMA (aka DeceptiveDevelopment, Contagious Interview) has targeted software developers and cryptocurrency professionals since 2023, according to MITRE ATT&CK. Between April and September 2026, ESET observed its operations extending into the wider software supply chain.
A developer runs the interview task, and the malware harvests Git credentials, SSH keys, and access tokens. The threat actor then injects malicious code into the victim's public and private repositories, often rewriting commit history to hide the change. Poisoned packages reached npm, the Go module mirror, Packagist, and PyPI. Others reached browser extension marketplaces. Most were small utilities maintained by individuals. ESET reads the pattern as automated propagation rather than deliberate targeting, with each compromised project becoming another potential entry point to downstream users.
Command-and-control resolution now runs through a blockchain. OpenSourceMalware named the technique NullReceiver in August. The loader reads the latest transaction sent from a hardcoded Ethereum address and decodes the server's IP address from the recipient address of a zero-value transfer. Changing servers takes one new transaction and no package update, while removing an existing blockchain record is impractical. ESET found the technique inside a legitimate developer's GitHub repository, launched by a hidden Visual Studio Code task. ESET describes it as the first blockchain-based command-and-control resolution observed embedded directly in a GitHub-hosted project.
FAMOUS CHOLLIMA is also adopting infrastructure complicating takedowns. ESET found malicious coding challenges hosted on Gitea, a self-hosted GitHub alternative with no central service responsible for removing every repository. Later-stage payloads sat on IPFS behind the Pinata gateway, where closing an account does not necessarily remove the underlying file. Several infection sequences ended in OmniStealer, a cross-platform Python infostealer. It collects browser credentials, cryptocurrency wallets, password manager data, and developer secrets.
Updated DEV#POPPER RAT variants establish persistence through VS Code, Cursor, and Discord, allowing the backdoor to execute again when developers open those applications. The backdoor outlives the fake interview by running inside tools developers open every day.
In September 2025, the self-replicating Shai-Hulud worm compromised more than 500 npm packages by stealing developer tokens and automatically republishing tainted versions. FAMOUS CHOLLIMA applies related supply-chain techniques through compromised maintainer credentials and malicious repository changes. A single maintainer account was enough when one hijacked account put 245 million downloads of a Rust crate at risk. FAMOUS CHOLLIMA harvests the credentials capable of producing similar exposure across multiple software ecosystems.
ESET does not report FAMOUS CHOLLIMA targeting drone manufacturers. Its propagation pattern suggests no exclusive industry focus, but Europe's drone companies depend on the same open-source ecosystem as everyone else. A poisoned utility could enter a defense company's build pipeline without a recruiter ever approaching its engineers.
Much of the observed collection is financial, involving wallets and credentials useful for theft. Access obtained for revenue could also reveal sensitive development environments, including those belonging to defense suppliers. An account compromised for financial gain can expose information valuable to espionage without requiring a separate initial intrusion.
Angles Defenders Have Not Weighed
Publication and the Visibility Gap
ESET's October 2025 publication preceded an approximately eight-month gap in its observation of related drone-focused activity. Around June 2026, the targeting resurfaced with updated tooling. Publication may have contributed to retooling, but the observations do not establish why the activity disappeared or whether operations continued elsewhere. Intelligence publication creates a recurring trade-off. Disclosing techniques helps potential victims recognize intrusions while informing adversaries which capabilities defenders have identified.
Hiring as an Attack Surface
Both campaigns exploit recruitment, one by impersonating employers and the other by impersonating interviewers. A fake job interview also opened the door in the record Binance theft. FAMOUS CHOLLIMA is also associated with North Korea's remote IT worker operations, creating an overlap between fake applicants seeking employment and fake interviewers delivering malware. A fast-growing drone startup can face all three approaches. Fake applicants reach hiring managers, fake offers reach engineers, and malicious coding challenges reach developers whose software enters the company's systems.
Ukraine's Combat Data
European drone manufacturers improve their products through battlefield feedback from Ukraine, including performance against jamming, spoofing, and air defenses. Such feedback may be worth more to North Korea than a design file alone because it records what works against an adapting adversary. I hold specific tasking to acquire Ukrainian performance data at low confidence. Companies retaining detailed battlefield telemetry should still recognize its intelligence value alongside conventional intellectual property.
Innocent Infrastructure
Operation DreamJob command-and-control servers include compromised mail servers at South American universities and government institutions. Those organizations become unwilling infrastructure providers for espionage against third parties. Remediation depends on their cooperation, technical capacity, and the jurisdictions in which they operate. Check Point also documented exploitation of the Roundcube vulnerability CVE-2025-49113 in related activity. The relays show where vulnerable systems existed and say nothing about where the adversary sits.
Names Hide Missions
ESET reports Operation DreamJob under the Lazarus umbrella, while CrowdStrike associates overlapping espionage activity with LABYRINTH CHOLLIMA and distinguishes financially motivated activity under other CHOLLIMA designations. Those names represent different analytical boundaries, and vendor mappings should not substitute for operational evidence. A defender reading "Lazarus targets drones" learns less than one distinguishing the espionage mission from credential theft and revenue generation. As I argued in my analysis of threat actor naming, the label shapes the defense.
North Korea is learning the future of warfare from several directions at once. Its technicians gain industrial experience from Russian assembly lines while their government collects revenue from overseas labor. Its intelligence services target European engineers for reconnaissance, sensor, and manufacturing know-how. Financially motivated threat actors turn open-source code into a distribution network, while other North Korean collection activity may extend toward Moscow's interests. The evidence does not demonstrate a single coordinated collection plan across these operations.
Each channel fills a gap the others leave. European compromises supply technologies Moscow has not transferred, and software supply-chain intrusions reach victims no recruiter could. Europe's drone boom runs on speed, open recruitment, and open-source software, and each of those strengths gives North Korea a door. The engineers designing the drones Ukraine flies today are already on North Korea's collection list, and the governments funding them should protect those engineers as carefully as the drones themselves.