MITRE ATT&CKcampaign
C0022 Operation Dream Job
- Domain
- enterprise
- Aliases
- Operation North Star, Operation Interception
- Version
- 1.2
- Created
- 2023-03-17
Description
Operation Dream Job was a cyber espionage operation likely conducted by Lazarus Group that targeted the defense, aerospace, government, and other sectors in the United States, Israel, Australia, Russia, and India. In at least one case, the cyber actors tried to monetize their network access to conduct a business email compromise (BEC) operation. In 2020, security researchers noted overlapping TTPs, to include fake job lures and code similarities, between Operation Dream Job, Operation North Star, and Operation Interception; by 2022 security researchers described Operation Dream Job as an umbrella term covering both Operation Interception and Operation North Star.
Related
Attributed to · MITRE ATT&CK (1)
- G0032 Lazarus Group group
Uses · MITRE ATT&CK (58)
- T1684.001 Impersonation sub-technique
- T1027.013 Encrypted/Encoded File sub-technique
- T1036.008 Masquerade File Type sub-technique
- T1622 Debugger Evasion technique
- S0694 DRATzarus software (malware)
- S0678 Torisma software (malware)
- T1614.001 System Language Discovery sub-technique
- T1505.004 IIS Components sub-technique
- T1608.001 Upload Malware sub-technique
- T1608.002 Upload Tool sub-technique
- T1589 Gather Victim Identity Information technique
- T1591 Gather Victim Org Information technique
- T1591.004 Identify Roles sub-technique
- T1593.001 Social Media sub-technique
- T1583.004 Server sub-technique
- T1583.006 Web Services sub-technique
- T1584.001 Domains sub-technique
- T1584.004 Server sub-technique
- T1585.001 Social Media Accounts sub-technique
- T1585.002 Email Accounts sub-technique
- T1587.001 Malware sub-technique
- T1587.002 Code Signing Certificates sub-technique
- T1588.002 Tool sub-technique
- T1588.003 Code Signing Certificates sub-technique
- T1583.001 Domains sub-technique
- T1573.001 Symmetric Cryptography sub-technique
- T1071.001 Web Protocols sub-technique
- T1204.001 Malicious Link sub-technique
- T1204.002 Malicious File sub-technique
- T1059.001 PowerShell sub-technique
References
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/operation-north-star-behind-the-scenes/ McAfee Lazarus Nov 2020
- https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_Operation_Interception.pdf ESET Lazarus Jun 2020
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/operation-north-star-a-job-offer-thats-too-good-to-be-true/?hilite=%27Operation%27%2C%27North%27%2C%27Star%27 McAfee Lazarus Jul 2020
- https://www.clearskysec.com/wp-content/uploads/2020/08/Dream-Job-Campaign.pdf ClearSky Lazarus Aug 2020
- https://thehackernews.com/2022/08/north-korea-hackers-spotted-targeting.html The Hacker News Lazarus Aug 2022