modified: 2024-04-11T00:31:21.576Z
name: Operation Dream Job
description: [Operation Dream Job](https://attack.mitre.org/campaigns/C0022) was a cyber espionage operation likely conducted by [Lazarus Group](https://attack.mitre.org/groups/G0032) that targeted the defense, aerospace, government, and other sectors in the United States, Israel, Australia, Russia, and India. In at least one case, the cyber actors tried to monetize their network access to conduct a business email compromise (BEC) operation. In 2020, security researchers noted overlapping TTPs, to include fake job lures and code similarities, between [Operation Dream Job](https://attack.mitre.org/campaigns/C0022), Operation North Star, and Operation Interception; by 2022 security researchers described [Operation Dream Job](https://attack.mitre.org/campaigns/C0022) as an umbrella term covering both Operation Interception and Operation North Star.(Citation: ClearSky Lazarus Aug 2020)(Citation: McAfee Lazarus Jul 2020)(Citation: ESET Lazarus Jun 2020)(Citation: The Hacker News Lazarus Aug 2022)
aliases: Operation Dream Job
Operation North Star
Operation Interception
first_seen: 2019-09-01T04:00:00.000Z
last_seen: 2020-08-01T04:00:00.000Z
x_mitre_first_seen_citation: (Citation: ESET Lazarus Jun 2020)
x_mitre_last_seen_citation: (Citation: ClearSky Lazarus Aug 2020)
x_mitre_deprecated: no
x_mitre_version: 1.2
type: campaign
spec_version: 2.1
id: campaign--0257b35b-93ef-4a70-80dd-ad5258e6045b
created: 2023-03-17T13:37:42.596Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/campaigns/C0022
external_id: C0022
source_name: Operation Interception
description: (Citation: ESET Lazarus Jun 2020)
source_name: Operation North Star
description: (Citation: McAfee Lazarus Jul 2020)(Citation: McAfee Lazarus Nov 2020)
source_name: McAfee Lazarus Nov 2020
description: Beek, C. (2020, November 5). Operation North Star: Behind The Scenes. Retrieved December 20, 2021.
url: https://www.mcafee.com/blogs/other-blogs/mcafee-labs/operation-north-star-behind-the-scenes/
source_name: ESET Lazarus Jun 2020
description: Breitenbacher, D and Osis, K. (2020, June 17). OPERATION IN(TER)CEPTION: Targeted Attacks Against European Aerospace and Military Companies. Retrieved December 20, 2021.
url: https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_Operation_Interception.pdf
source_name: McAfee Lazarus Jul 2020
description: Cashman, M. (2020, July 29). Operation North Star Campaign. Retrieved December 20, 2021.
url: https://www.mcafee.com/blogs/other-blogs/mcafee-labs/operation-north-star-a-job-offer-thats-too-good-to-be-true/?hilite=%27Operation%27%2C%27North%27%2C%27Star%27
source_name: ClearSky Lazarus Aug 2020
description: ClearSky Research Team. (2020, August 13). Operation 'Dream Job' Widespread North Korean Espionage Campaign. Retrieved December 20, 2021.
url: https://www.clearskysec.com/wp-content/uploads/2020/08/Dream-Job-Campaign.pdf
source_name: The Hacker News Lazarus Aug 2022
description: Lakshmanan, R. (2022, August 17). North Korea Hackers Spotted Targeting Job Seekers with macOS Malware. Retrieved April 10, 2023.
url: https://thehackernews.com/2022/08/north-korea-hackers-spotted-targeting.html
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_domains: enterprise-attack
ics-attack