NK Hackers Prey on Devs with Fake Job Offers

A North Korean threat actor, identified as UNK_DeadDrop, is actively targeting software developers with deceptive email-based job lures. This campaign shares similarities with previous Lazarus group operations, notably the Contagious Interview and Operation DreamJob campaigns, which also targeted developers for financial gain. These past Lazarus campaigns involved creating fake company profiles and offering high-paying positions in AI and Web 3 organizations.

However, UNK_DeadDrop distinguishes itself by primarily using email for initial contact, rather than social media platforms like LinkedIn. The group also utilizes a new, self-contained payload, differing from earlier Lazarus campaigns. Proofpoint researchers observe that this evolution, shifting from social engineering to mass phishing with malicious code repositories, suggests a maturation and industrialization of North Korean-aligned operations aiming to scale their financial exploitation efforts.