Cybersecurity company ESET identified the campaigns in its APT Activity Report published on October 28, covering operations observed between April and September 2026. The findings identify renewed drone-sector targeting by Lazarus and an expansion of software supply-chain attacks by another North Korea-aligned group, DeceptiveDevelopment.
Researchers found that Lazarus had resumed operations against organisations involved in drone technology, typically exploiting recruitment-themed social engineering to establish initial access. Such approaches involve impersonating prospective employers or recruiters to persuade targeted individuals to interact with malicious material.
ESET believes the targeting reflects the growing military importance of unmanned aircraft in Ukraine, where battlefield operations have accelerated the development and testing of drone systems. Information about manufacturing processes, technical capabilities and operational practices could assist North Korea’s own drone development, although the researchers presented that motivation as an assessment rather than an established objective.
The second campaign involved DeceptiveDevelopment, which moved beyond fraudulent job interviews towards compromising software development infrastructure. Researchers observed the group harvesting developer credentials and exploiting that access to insert malicious code into public and private source code repositories.
This approach creates risks extending beyond the initially compromised developer. Software repositories contain code used to build applications and services, meaning unauthorised modifications can potentially affect other developers, organisations and customers that depend on the affected projects.
Unlike attacks focused exclusively on stealing information, repository compromises can provide opportunities to manipulate software before distribution. The extent of any downstream infections, however, was not quantified in ESET’s publicly released findings.
The two campaigns illustrate distinct methods of accessing strategically valuable technology. Lazarus concentrated on organisations possessing specialised drone knowledge, while DeceptiveDevelopment targeted the development processes through which software is created, maintained and shared.
ESET also identified Ukraine as an increasingly prominent target for North Korea-aligned operations, alongside South Korea. Technology businesses, cryptocurrency companies and software developers remained the principal categories of targets, broadly consistent with previous monitoring periods.
The researchers suggested that growing attention towards Ukraine could be connected to strengthening military cooperation between Pyongyang and Moscow. North Korea’s involvement in Russia’s war, including military supplies and troop deployments, provides a possible explanation for overlapping intelligence interests.
However, ESET did not establish that every operation targeting Ukraine was coordinated with Russia. Its assessment distinguished similarities in strategic interests from evidence demonstrating direct operational cooperation between hacking groups.
The findings place particular emphasis on recruitment deception because developers and engineers frequently receive unsolicited employment approaches. Attackers can exploit these professional interactions to establish contact, solicit credentials or persuade individuals to execute files presented as legitimate recruitment materials.
For drone manufacturers, the exposure involves more than conventional business information. Engineering documentation, production methods and technical expertise can have military applications, making access to specialised industrial knowledge particularly valuable to intelligence collectors.
For software organisations, compromised developer accounts present a different security challenge. Credentials granting repository access can permit unauthorised changes to projects without requiring attackers to breach every organisation subsequently using the software.
ESET’s findings nevertheless distinguish observed intrusions from their potential consequences. The public overview does not establish that every targeted drone company lost proprietary designs or that every manipulated repository distributed malicious software to customers.
The report also examined the adoption of artificial intelligence by state-aligned hacking groups. Researchers identified instances of large language models assisting malware development and the creation of deceptive websites, although they found no evidence that artificial intelligence had fundamentally transformed advanced persistent threat operations during the six-month period.
Jean-Ian Boutin, ESET’s director of threat research, said attackers were employing artificial intelligence primarily to accelerate labour-intensive activities, including developing malicious software and constructing websites intended to deceive victims.
The wider assessment also documented intelligence operations attributed to China-aligned groups, renewed activity by Iran-aligned attackers and growing similarities between Belarusian and Russian cyber campaigns. Those findings were presented separately from the North Korean operations.
Another North Korea-aligned group, ScarCruft, was detected targeting an African country. ESET assessed that the operation might have been intended to monitor a North Korean overseas worker scheme or observe Russian activities there. Neither explanation was established conclusively, and the public findings did not identify the affected organisation.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
