The North Korean-linked Lazarus Group is back again with continued activity associated to their long-running campaign known as Operation Dream Job, less than a month after their observed spear phishing campaign against a Spanish aerospace company. This recent activity involves the use of trojanized versions of Virtual Network Computing (VNC) applications to target the defense industry and nuclear engineers. The modus operandi of Lazarus’ Operation Dream Job involves contacting victims from fake accounts, usually via LinkedIn, Telegram, and WhatsApp, and offering lucrative job opportunities and fake job interviews while attempting to trick the victim into downloading malware, presumably for the purpose of advancing the North Korean nuclear program. The targets of the group’s most recent venture include employees at organizations directly involved in defense manufacturing, including radar systems, unmanned aerial vehicles (UAVs), military vehicles, ships, weaponry, and maritime companies. Lazarus and North Korean threat actors in general are known for their continued adaptation and ability to build tailored malware for a range of different platforms. As a part of this latest portion of their campaign, Lazarus has attempted to trick job seekers on social media into opening malicious trojanized VNC apps for fake job interviews. When the app is launched by the victim, the app retrieves additional payloads such as a commonly known Lazarus Group malware called LPEClient that’s capable of profiling compromised hosts. There are also instances of an updated version of COPPERHEDGE being used, a backdoor known for running arbitrary commands, performing system reconnaissance, and exfiltrating data. Another aspect of the ongoing campaign is custom malware built specifically for transmitting files of interest to a remote server. CTIX analysts will continue to release updates about developments pertaining to Lazarus Group and associated activity.