Fast Facts

• North Korean hackers used WhatsApp Web to target manufacturing engineers with fake job offers.
• The attack chain involved a booby-trapped PDF and advanced malware, granting deep network access.
• Attackers exploited legitimate software, sideloading malicious code to bypass security.
• Reconnaissance and lateral movement were achieved using compromised WordPress sites and stolen credentials.
• The campaign is attributed to UNC2970, a group linked to North Korean state cyber operations.

Inside the New Cyber Espionage Playbook

Imagine a digital wolf in sheep’s clothing: a job offer that arrives not by email, but through WhatsApp, promising a lucrative position to an unsuspecting engineer. This is the latest twist in North Korea’s ongoing Operation DreamJob-a campaign that has evolved from classic phishing emails to covert attacks using messaging apps, targeting the manufacturing sector’s vital arteries.

In August 2025, security experts from Orange Cyberdefense uncovered a sophisticated breach at an Asian arm of a major European manufacturer. The attackers posed as recruiters, sending a WhatsApp message offering a “Project Manager” role. The message contained a ZIP file with a seemingly harmless PDF and a legitimate application (SumatraPDF.exe), but hidden within was a trojanized component (libmupdf.dll) primed to open a backdoor into the company’s network.

How the Attack Unfolded: Simple Tricks, Complex Consequences

The infection chain was both simple and insidious. When the engineer opened the PDF, the legitimate PDF reader quietly loaded the malicious DLL, giving hackers their first foothold. But this was just the start. Once inside, the attackers conducted hours of hands-on activity-scouring the company’s digital directories, targeting backup and admin accounts, and hopping between servers using stolen credentials, all while hiding their command signals in compromised WordPress sites.

The malware used in this campaign marks an evolution in DreamJob’s arsenal. The updated BURNBOOK malware detects when it’s running inside a company network, and the MISTPEN backdoor, injected into real software, quietly contacts the attackers through SharePoint-based channels. The final payload, ReleasePvPluginx64.dll, is an information thief: it silently gathers and sends sensitive company data to North Korean servers.

Why Manufacturing? And Why WhatsApp?

Manufacturing firms are prime targets: they design high-value products, manage complex supply chains, and hold intellectual property that’s a goldmine for nation-states. By exploiting WhatsApp Web-a platform typically viewed as less risky than email-the attackers bypassed many traditional defenses. This reflects a broader trend: as companies tighten email security, attackers shift to less-guarded channels.

Previous DreamJob campaigns, dating back to 2016, have exploited LinkedIn and email. But the move to WhatsApp shows an adaptive adversary, always seeking the path of least resistance. Reports from Mandiant and the U.S. CISA have documented similar social engineering ploys, highlighting a persistent North Korean focus on industries with strategic value.

Defending the Digital Factory Floor

For defenders, the lesson is clear: vigilance must extend beyond the inbox. Blocking risky use of messaging apps on work devices, monitoring for unusual software behaviors (like PDF readers running from odd locations), and educating staff about modern social engineering tactics are now essential. As attackers refine their methods, security must evolve in step-because in the new era of cyber-espionage, even a job offer can be a Trojan horse.

WIKICROOK

• DLL Sideloading: DLL sideloading is when attackers trick trusted programs into loading malicious helper files (DLLs) instead of the legitimate ones, enabling hidden attacks.
• Social Engineering: Social engineering is the use of deception by hackers to trick people into revealing confidential information or providing unauthorized system access.
• Command: A command is an instruction sent to a device or software, often by a C2 server, directing it to perform specific actions, sometimes for malicious purposes.
• Pass: Pass-the-Hash is a cyberattack where attackers use stolen password hashes to access systems, bypassing the need for the actual password.
• Backdoor: A backdoor is a hidden way to access a computer or server, bypassing normal security checks, often used by attackers to gain secret control.