North Korean Hackers Target Drone Technology and Software Supply Chains in New Cyberespionage Campaigns
North Korean hackers target drone tech and software supply chains with new malware.
North Korean threat actors Lazarus and DeceptiveDevelopment have renewed efforts to steal drone technology and expand attacks against software developers. Lazarus targeted European defense companies with trojanized software, while DeceptiveDevelopment used stolen developer credentials to inject malicious code into software supply chains across multiple package managers. ESET researchers identified new malware variants including MortPusLoader, LightlessTeaR, OmniStealer, and DEV#POPPER RAT.
AI summary of the linked source. Not reviewed by an editor. How this works
Run ESET?
Get an email when a new story names ESET, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Lazarus Group and DeceptiveDevelopment campaigns illustrate how nation-state actors exploit trusted software distribution channels and stolen developer credentials to achieve wide-scale compromise. By trojanizing legitimate software packages and injecting malicious code into package managers, attackers can silently reach thousands of downstream users who implicitly trust signed or published packages. Stolen developer credentials served as the entry point, bypassing perimeter defenses entirely by impersonating legitimate contributors. This matters because a single compromised developer account or poisoned package can cascade into dozens of organizations, making the software supply chain one of the highest-leverage attack surfaces today.
What helps against this
How we list vendors
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — MortPusLoader
- malware — LightlessTeaR
- malware — OmniStealer
- malware — DEV#POPPER RAT
- malware — BinMergeLoader
- malware — ScoringMathTea
- malware — NullReceiver