ESET attributes a new wave of Operation DreamJob activity to North Korea-aligned Lazarus with high confidence, citing fake job-offer social engineering, trojanized open-source projects, DLL side-loading, and the ScoringMathTea RAT. The observed intrusions targeted three European defense-sector companies, including organizations involved in aircraft components, metal engineering, and UAV-related technology. Victims were lured with a decoy job description and a trojanized PDF reader, after which droppers using the internal name DroneEXEHijackingLoader.dll led to ScoringMathTea deployment through compromised C2 servers. The campaign matters because ESET connects the targeting to possible collection of proprietary UAV know-how as North Korea expands its drone program and gains wartime exposure through Russia’s war against Ukraine.