Dream-Job-Campaign.pdf (2 MB)

ClearSky attributes Operation Dream Job with high probability to North Korea-linked Lazarus, also known as Hidden Cobra, and describes a 2020 espionage campaign against defense, government, and related organizations in Israel and globally. The attackers used fictitious LinkedIn recruiter personas, personal email, phone calls, WhatsApp conversations, and malicious job-offer files to infect targets, collect intelligence about organizational activity and finances, and support both espionage and potential theft objectives.