Operation Dream Job

Campaign overview

MITRE ATT&CK historical record. Dates reflect source observations. Current activity and target-region classification are not asserted; Global denotes unclassified catalogue coverage. Operation Dream Job was a cyber espionage operation likely conducted by Lazarus Group that targeted the defense, aerospace, government, and other sectors in the United States, Israel, Australia, Russia, and India. In at least one case, the cyber actors tried to monetize their network access to conduct a business email compromise (BEC) operation. In 2020, security researchers noted overlapping TTPs, to include fake job lures and code similarities, between Operation Dream Job, Operation North Star, and Operation Interception; by 2022 security researchers described Operation Dream Job as an umbrella term covering both Operation Interception and Operation North Star.(Citation: ClearSky Lazarus Aug 2020)(Citation: McAfee Lazarus Jul 2020)(Citation: ESET Lazarus Jun 2020)(Citation: The Hacker News Lazarus Aug 2022)

This is a historical record and does not establish current campaign activity.

Threat actor

Lazarus Group

Attribution confidence

Not established

First documented activity

2019-09-01

End date

Not established

Estimated victims

Not established

Reported impact

Not established

Unknown attribution, confidence and impact remain unspecified. Regional labels can include unspecified targets; assess the source evidence before acting.

Documented timeline

1. 2019-09-01

   Source-reported first observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

2. 2020-08-01

   Source-reported last observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

MITRE ATT&CK techniques

• T1614.001 · System Language Discovery

  Discovery — During Operation Dream Job, Lazarus Group deployed malware designed not to run on computers set to Korean, Japanese, or Chinese in Windows language preferences.(Citation: ClearSky Lazarus Aug 2020)

• T1608.001 · Upload Malware

  Resource Development — For Operation Dream Job, Lazarus Group used compromised servers to host malware.(Citation: ClearSky Lazarus Aug 2020)(Citation: ESET Lazarus Jun 2020)(Citation: McAfee Lazarus Jul 2020)(Citation: McAfee Lazarus Nov 2020)

• T1218.011 · Rundll32

  Stealth — During Operation Dream Job, Lazarus Group executed malware with `C:\\windows\system32\rundll32.exe "C:\ProgramData\ThumbNail\thumbnail.db"`, `CtrlPanel S-6-81-3811-75432205-060098-6872 0 0 905`.(Citation: ClearSky Lazarus Aug 2020)(Citation: ESET Lazarus Jun 2020)(Citation: McAfee Lazarus Jul 2020)

• T1106 · Native API

  Execution — During Operation Dream Job, Lazarus Group used Windows API `ObtainUserAgentString` to obtain the victim's User-Agent and used the value to connect to their C2 server.(Citation: McAfee Lazarus Jul 2020)

• T1585.001 · Social Media Accounts

  Resource Development — For Operation Dream Job, Lazarus Group created fake LinkedIn accounts for their targeting efforts.(Citation: ClearSky Lazarus Aug 2020)(Citation: ESET Lazarus Jun 2020)

• T1036.008 · Masquerade File Type

  Stealth — During Operation Dream Job, Lazarus Group disguised malicious template files as JPEG files to avoid detection.(Citation: McAfee Lazarus Jul 2020)(Citation: ESET Lazarus Jun 2020)

• T1070.004 · File Deletion

  Stealth — During Operation Dream Job, Lazarus Group removed all previously delivered files from a compromised computer.(Citation: ESET Lazarus Jun 2020)

• T1547.001 · Registry Run Keys / Startup Folder

  Persistence, Privilege Escalation — During Operation Dream Job, Lazarus Group placed LNK files into the victims' startup folder for persistence.(Citation: McAfee Lazarus Jul 2020)

• T1497.001 · System Checks

  Stealth, Discovery — During Operation Dream Job, Lazarus Group used tools that conducted a variety of system checks to detect sandboxes or VMware services.(Citation: ClearSky Lazarus Aug 2020)

• T1059.005 · Visual Basic

  Execution — During Operation Dream Job, Lazarus Group executed a VBA written malicious macro after victims download malicious DOTM files; Lazarus Group also used Visual Basic macro code to extract a double Base64 encoded DLL implant.(Citation: ClearSky Lazarus Aug 2020)(Citation: McAfee Lazarus Jul 2020)

• T1608.002 · Upload Tool

  Resource Development — For Operation Dream Job, Lazarus Group used multiple servers to host malicious tools.(Citation: ESET Lazarus Jun 2020)

• T1105 · Ingress Tool Transfer

  Command And Control — During Operation Dream Job, Lazarus Group downloaded multistage malware and tools onto a compromised host.(Citation: ClearSky Lazarus Aug 2020)(Citation: ESET Lazarus Jun 2020)(Citation: McAfee Lazarus Jul 2020)

• T1585.002 · Email Accounts

  Resource Development — During Operation Dream Job, Lazarus Group created fake email accounts to correspond with fake LinkedIn personas; Lazarus Group also established email accounts to match those of the victim as part of their BEC attempt.(Citation: ESET Lazarus Jun 2020)

• T1584.001 · Domains

  Resource Development — For Operation Dream Job, Lazarus Group compromised domains in Italy and other countries for their C2 infrastructure.(Citation: McAfee Lazarus Jul 2020)(Citation: McAfee Lazarus Nov 2020)

• T1583.004 · Server

  Resource Development — During Operation Dream Job, Lazarus Group acquired servers to host their malicious tools.(Citation: ESET Lazarus Jun 2020)

• T1573.001 · Symmetric Cryptography

  Command And Control — During Operation Dream Job, Lazarus Group used an AES key to communicate with their C2 server.(Citation: McAfee Lazarus Jul 2020)

• T1204.001 · Malicious Link

  Execution — During Operation Dream Job, Lazarus Group lured users into executing a malicious link to disclose private account information or provide initial access.(Citation: ClearSky Lazarus Aug 2020)(Citation: ESET Lazarus Jun 2020)

• T1059.001 · PowerShell

  Execution — During Operation Dream Job, Lazarus Group used PowerShell commands to explore the environment of compromised victims.(Citation: ESET Lazarus Jun 2020)

• T1591 · Gather Victim Org Information

  Reconnaissance — For Operation Dream Job, Lazarus Group gathered victim organization information to identify specific targets.(Citation: ClearSky Lazarus Aug 2020)

• T1583.001 · Domains

  Resource Development — During Operation Dream Job, Lazarus Group registered a domain name identical to that of a compromised company as part of their BEC effort.(Citation: ESET Lazarus Jun 2020)

• T1221 · Template Injection

  Stealth — During Operation Dream Job, Lazarus Group used DOCX files to retrieve a malicious document template/DOTM file.(Citation: ClearSky Lazarus Aug 2020)(Citation: McAfee Lazarus Jul 2020)

• T1497.003 · Time Based Checks

  Stealth, Discovery — During Operation Dream Job, Lazarus Group used tools that collected `GetTickCount` and `GetSystemTimeAsFileTime` data to detect sandbox or VMware services.(Citation: ClearSky Lazarus Aug 2020)

• T1589 · Gather Victim Identity Information

  Reconnaissance — For Operation Dream Job, Lazarus Group conducted extensive reconnaissance research on potential targets.(Citation: ClearSky Lazarus Aug 2020)

• T1553.002 · Code Signing

  Defense Impairment — During Operation Dream Job, Lazarus Group digitally signed their own malware to evade detection.(Citation: ESET Lazarus Jun 2020)

• T1005 · Data from Local System

  Collection — During Operation Dream Job, Lazarus Group used malicious Trojans and DLL files to exfiltrate data from an infected host.(Citation: ClearSky Lazarus Aug 2020)(Citation: McAfee Lazarus Jul 2020)

• T1110 · Brute Force

  Credential Access — During Operation Dream Job, Lazarus Group performed brute force attacks against administrator accounts.(Citation: ESET Lazarus Jun 2020)

• T1041 · Exfiltration Over C2 Channel

  Exfiltration — During Operation Dream Job, Lazarus Group exfiltrated data from a compromised host to actor-controlled C2 servers.(Citation: ClearSky Lazarus Aug 2020)

• T1534 · Internal Spearphishing

  Lateral Movement — During Operation Dream Job, Lazarus Group conducted internal spearphishing from within a compromised organization.(Citation: ClearSky Lazarus Aug 2020)

• T1684.001 · Impersonation

  Stealth — During Operation Dream Job, Lazarus Group impersonated HR hiring personnel through LinkedIn messages and conducted interviews with victims in order to deceive them into downloading malware.(Citation: ClearSky Lazarus Aug 2020)(Citation: ESET Lazarus Jun 2020)(Citation: The Hacker News Lazarus Aug 2022)

• T1583.006 · Web Services

  Resource Development — During Operation Dream Job, Lazarus Group used file hosting services like DropBox and OneDrive.(Citation: ClearSky Lazarus Aug 2020)

• T1566.003 · Spearphishing via Service

  Initial Access — During Operation Dream Job, Lazarus Group sent victims spearphishing messages via LinkedIn concerning fictitious jobs.(Citation: ClearSky Lazarus Aug 2020)(Citation: ESET Lazarus Jun 2020)

• T1591.004 · Identify Roles

  Reconnaissance — During Operation Dream Job, Lazarus Group targeted specific individuals within an organization with tailored job vacancy announcements.(Citation: ClearSky Lazarus Aug 2020)(Citation: ESET Lazarus Jun 2020)

• T1053.005 · Scheduled Task

  Execution, Persistence, Privilege Escalation — During Operation Dream Job, Lazarus Group created scheduled tasks to set a periodic execution of a remote XSL script.(Citation: ESET Lazarus Jun 2020)

• T1204.002 · Malicious File

  Execution — During Operation Dream Job, Lazarus Group lured victims into executing malicious documents that contained "dream job" descriptions from defense, aerospace, and other sectors.(Citation: ClearSky Lazarus Aug 2020)(Citation: McAfee Lazarus Jul 2020)

• T1588.003 · Code Signing Certificates

  Resource Development — During Operation Dream Job, Lazarus Group used code signing certificates issued by Sectigo RSA for some of its malware and tools.(Citation: ESET Lazarus Jun 2020)

• T1087.002 · Domain Account

  Discovery — During Operation Dream Job, Lazarus Group queried compromised victim's active directory servers to obtain the list of employees including administrator accounts.(Citation: ESET Lazarus Jun 2020)

• T1587.002 · Code Signing Certificates

  Resource Development — During Operation Dream Job, Lazarus Group digitally signed their malware and the dbxcli utility.(Citation: ESET Lazarus Jun 2020)

• T1566.001 · Spearphishing Attachment

  Initial Access — During Operation Dream Job, Lazarus Group sent emails with malicious attachments to gain unauthorized access to targets' computers.(Citation: ClearSky Lazarus Aug 2020)(Citation: McAfee Lazarus Jul 2020)

• T1505.004 · IIS Components

  Persistence — During Operation Dream Job, Lazarus Group targeted Windows servers running Internet Information Systems (IIS) to install C2 components.(Citation: McAfee Lazarus Jul 2020)

• T1083 · File and Directory Discovery

  Discovery — During Operation Dream Job, Lazarus Group conducted word searches within documents on a compromised host in search of security and financial matters.(Citation: ClearSky Lazarus Aug 2020)

• T1218.010 · Regsvr32

  Stealth — During Operation Dream Job, Lazarus Group used `regsvr32` to execute malware.(Citation: ESET Lazarus Jun 2020)

• T1047 · Windows Management Instrumentation

  Execution — During Operation Dream Job, Lazarus Group used WMIC to executed a remote XSL script.(Citation: ESET Lazarus Jun 2020)

• T1027.002 · Software Packing

  Stealth — During Operation Dream Job, Lazarus Group packed malicious .db files with Themida to evade detection.(Citation: ClearSky Lazarus Aug 2020)(Citation: McAfee Lazarus Jul 2020)(Citation: McAfee Lazarus Nov 2020)

• T1588.002 · Tool

  Resource Development — For Operation Dream Job, Lazarus Group obtained tools such as Wake-On-Lan, Responder, ChromePass, and dbxcli.(Citation: ClearSky Lazarus Aug 2020)(Citation: ESET Lazarus Jun 2020)

• T1071.001 · Web Protocols

  Command And Control — During Operation Dream Job, Lazarus Group uses HTTP and HTTPS to contact actor-controlled C2 servers.(Citation: McAfee Lazarus Jul 2020)

• T1567.002 · Exfiltration to Cloud Storage

  Exfiltration — During Operation Dream Job, Lazarus Group used a custom build of open-source command-line dbxcli to exfiltrate stolen data to Dropbox.(Citation: ESET Lazarus Jun 2020)(Citation: ClearSky Lazarus Aug 2020)

• T1622 · Debugger Evasion

  Stealth, Discovery — During Operation Dream Job, Lazarus Group used tools that used the `IsDebuggerPresent` call to detect debuggers.(Citation: ClearSky Lazarus Aug 2020)

• T1027.013 · Encrypted/Encoded File

  Stealth — During Operation Dream Job, Lazarus Group encrypted malware such as DRATzarus with XOR and DLL files with base64.(Citation: ClearSky Lazarus Aug 2020)(Citation: ESET Lazarus Jun 2020)(Citation: McAfee Lazarus Jul 2020)(Citation: McAfee Lazarus Nov 2020)

• T1220 · XSL Script Processing

  Stealth — During Operation Dream Job, Lazarus Group used a remote XSL script to download a Base64-encoded DLL custom downloader.(Citation: ESET Lazarus Jun 2020)

• T1587.001 · Malware

  Resource Development — For Operation Dream Job, Lazarus Group developed custom tools such as Sumarta, DBLL Dropper, Torisma, and DRATzarus for their operations.(Citation: ClearSky Lazarus Aug 2020)(Citation: ESET Lazarus Jun 2020)(Citation: McAfee Lazarus Jul 2020)(Citation: McAfee Lazarus Nov 2020)

• T1059.003 · Windows Command Shell

  Execution — During Operation Dream Job, Lazarus Group launched malicious DLL files, created new folders, and renamed folders with the use of the Windows command shell.(Citation: ESET Lazarus Jun 2020)(Citation: McAfee Lazarus Jul 2020)

• T1584.004 · Server

  Resource Development — For Operation Dream Job, Lazarus Group compromised servers to host their malicious tools.(Citation: ClearSky Lazarus Aug 2020)(Citation: ESET Lazarus Jun 2020)(Citation: McAfee Lazarus Jul 2020)

• T1593.001 · Social Media

  Reconnaissance — For Operation Dream Job, Lazarus Group used LinkedIn to identify and target employees within a chosen organization.(Citation: ESET Lazarus Jun 2020)

• T1566.002 · Spearphishing Link

  Initial Access — During Operation Dream Job, Lazarus Group sent malicious OneDrive links with fictitious job offer advertisements via email.(Citation: ClearSky Lazarus Aug 2020)(Citation: ESET Lazarus Jun 2020)

• T1560.001 · Archive via Utility

  Collection — During Operation Dream Job, Lazarus Group archived victim's data into a RAR file.(Citation: ESET Lazarus Jun 2020)

Linked indicators

0 reviewed indicators. An indicator’s presence does not establish that every resource on shared infrastructure is malicious.

No reviewed indicators are supplied. None are inferred from the campaign description.

Documented infrastructure

No reviewed infrastructure is supplied.

Sources and evidence

• MITRE ATT&CK C0022

  Official MITRE ATT&CK campaign record C0022. Derived from mitre/cti commit 50be388e93819a5d20e71cbaaeccfda157abc846. Actor links and technique mappings are attributed to this source; confidence, victims, monetary impact and infrastructure are not inferred.

External sources retain their own licences and sharing conditions. Request a correction with supporting evidence.