[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fpOBKAUnXN85EKKaIs-fHNEsRxiq4rs-_e56WgqIqfgc":3},{"article":4,"iocs":56,"watch_terms":77,"solutions":78,"lesson":170},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"0af9b392-baf6-4f82-9147-20508f653ee6","North Korean Hackers Target Drone Technology and Software Supply Chains in New Cyberespionage Campaigns","north-korean-hackers-target-drone-technology-and-software-supply-chains-in-new-c-db78a0","North Korean hackers have renewed efforts to steal drone technology while expanding attacks against software developers and the projects they maintain. Activity tracked between April and September 2026 shows Lazarus returning to European defense targets, while DeceptiveDevelopment used stolen developer credentials to spread malicious code through software supply chains. The campaigns share a familiar starting […] The post North Korean Hackers Target Drone Technology and Software Supply Chains in New Cyberespionage Campaigns appeared first on Cyber Security News.","North Korean threat actors Lazarus and DeceptiveDevelopment have renewed efforts to steal drone technology and expand attacks against software developers. Lazarus targeted European defense companies with trojanized software, while DeceptiveDevelopment used stolen developer credentials to inject malicious code into software supply chains across multiple package managers. ESET researchers identified new malware variants including MortPusLoader, LightlessTeaR, OmniStealer, and DEV#POPPER RAT.","North Korean hackers target drone tech and software supply chains with new malware.","https:\u002F\u002Fcybersecuritynews.com\u002Fnorth-korean-hackers-3\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FNorth-Korean-Hackers-Target-Drone-Technology-and-Software-Supply-Chains-in-New-Cyberespionage-Campaigns.webp","2026-11-10T14:09:27+00:00","2026-11-10T15:00:30.375541+00:00",8,[17,20,22,25,28,30],{"name":18,"type":19},"Lazarus","threat_actor",{"name":21,"type":19},"DeceptiveDevelopment",{"name":23,"type":24},"ESET","vendor",{"name":26,"type":27},"Notepad++","product",{"name":29,"type":27},"SumatraPDF",{"name":31,"type":32},"npm","technology","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":33,"icon":35,"name":36,"slug":37},null,"Nation-state","nation-state",[39,44,46,51],{"category":40},{"id":41,"icon":35,"name":42,"slug":43},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":45},{"id":33,"icon":35,"name":36,"slug":37},{"category":47},{"id":48,"icon":35,"name":49,"slug":50},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":52},{"id":53,"icon":35,"name":54,"slug":55},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[57,60,63,66,68,71,74],{"type":50,"value":58,"context":59},"MortPusLoader","Trojanized Notepad++ plugin used by Lazarus.",{"type":50,"value":61,"context":62},"LightlessTeaR","Payload used by Lazarus, a rewritten version of LightlessCan.",{"type":50,"value":64,"context":65},"OmniStealer","Malware identified in the campaigns.",{"type":50,"value":67,"context":65},"DEV#POPPER RAT",{"type":50,"value":69,"context":70},"BinMergeLoader","Previously used WinMerge plugins by Lazarus.",{"type":50,"value":72,"context":73},"ScoringMathTea","Also called ForestTiger, a payload used by Lazarus.",{"type":50,"value":75,"context":76},"NullReceiver","Execution chain component.",[23,26,29],{"controls":79,"vendors":164},[80,109,135],{"slug":81,"name":82,"problem":83,"products":84},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[85,93,101],{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"slug":110,"name":111,"problem":112,"products":113},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[114,120,128],{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":115,"product_name":116,"url":118,"description":119},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":110,"product_name":132,"url":133,"description":134},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"slug":136,"name":137,"problem":138,"products":139},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[140,148,156],{"vendor_slug":141,"vendor_name":142,"vendor_logo":143,"product_slug":144,"product_name":145,"url":146,"description":147},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":149,"vendor_name":150,"vendor_logo":151,"product_slug":152,"product_name":153,"url":154,"description":155},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",{"vendor_slug":157,"vendor_name":158,"vendor_logo":159,"product_slug":160,"product_name":161,"url":162,"description":163},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-curation","JFrog Curation","https:\u002F\u002Fjfrog.com\u002Fcuration\u002F","Blocks malicious and risky open-source packages before they enter your repositories.",[165],{"slug":166,"name":23,"logo_path":167,"roles":168},"eset","\u002Fvendor-logos\u002Feset.png",[169],"reported_by",{"slug":171,"title":172,"body":173,"framework_refs":174,"framework_notes":180},"north-korean-hackers-weaponize-developer-credentials-and-trojanized-software-to-infiltrate-supply-ch","North Korean Hackers Weaponize Developer Credentials and Trojanized Software to Infiltrate Supply Chains","The Lazarus Group and DeceptiveDevelopment campaigns illustrate how nation-state actors exploit trusted software distribution channels and stolen developer credentials to achieve wide-scale compromise. By trojanizing legitimate software packages and injecting malicious code into package managers, attackers can silently reach thousands of downstream users who implicitly trust signed or published packages. Stolen developer credentials served as the entry point, bypassing perimeter defenses entirely by impersonating legitimate contributors. This matters because a single compromised developer account or poisoned package can cascade into dozens of organizations, making the software supply chain one of the highest-leverage attack surfaces today.",[175,176,177,178,179],"NIST CSF 2.0 ID.SC-2: Suppliers and third-party partners of information systems","NIS2 Article 21(2)(d)","CIS Control 16: Application Software Security (v8)","NIST SP 800-53 SA-12: Supply Chain Protection","MITRE ATT&CK T1195: Supply Chain Compromise",{"NIS2 Article 21(2)(d)":181,"MITRE ATT&CK T1195: Supply Chain Compromise":182,"NIST SP 800-53 SA-12: Supply Chain Protection":183,"CIS Control 16: Application Software Security (v8)":184,"NIST CSF 2.0 ID.SC-2: Suppliers and third-party partners of information systems":185},"NIS2's supply chain security point requires organizations to manage the security risks arising from supplier and third-party relationships, directly covering the trojanized packages and compromised package manager accounts in this incident.","This technique directly describes adversaries tampering with software prior to delivery — matching Lazarus's trojanized software and DeceptiveDevelopment's malicious package injections — making it the precise attack pattern to model defenses against.","SA-12 specifically calls for protecting against supply chain threats by validating the integrity of software and components, which would have flagged the trojanized software and tampered packages distributed through legitimate channels.","CIS Control 16 requires organizations to manage the security lifecycle of internally developed and acquired software, including validating code integrity and scanning for malicious components introduced via supply chain compromise.","This category requires identifying and assessing supply chain risks; vetting developer dependencies and package repositories would have detected the malicious code injections before they reached downstream consumers."]