Operation Dream Job
Campaign · ATTACK:enterprise:C0022
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:C0022",
"title": "Operation Dream Job",
"type": "Campaign",
"source_url": "https://attack.mitre.org/campaigns/C0022",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "campaign--0257b35b-93ef-4a70-80dd-ad5258e6045b",
"external_id": "C0022",
"domain": "enterprise",
"created": "2023-03-17T13:37:42.596Z",
"modified": "2026-07-31T21:14:21.859Z",
"version": "1.2",
"aliases": [
"Operation Dream Job",
"Operation North Star",
"Operation Interception"
],
"tactics": [
],
"source_references": [
{
"source_name": "Operation Interception"
},
{
"source_name": "Operation North Star"
},
{
"source_name": "McAfee Lazarus Nov 2020",
"url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/operation-north-star-behind-the-scenes/"
},
{
"source_name": "ESET Lazarus Jun 2020",
"url": "https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_Operation_Interception.pdf"
},
{
"source_name": "McAfee Lazarus Jul 2020",
"url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/operation-north-star-a-job-offer-thats-too-good-to-be-true/?hilite=%27Operation%27%2C%27North%27%2C%27Star%27"
},
{
"source_name": "ClearSky Lazarus Aug 2020",
"url": "https://www.clearskysec.com/wp-content/uploads/2020/08/Dream-Job-Campaign.pdf"
},
{
"source_name": "The Hacker News Lazarus Aug 2022",
"url": "https://thehackernews.com/2022/08/north-korea-hackers-spotted-targeting.html"
}
]
}Explicit source assertions (59)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1614.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--04791b5e-1795-4a1c-a10d-71f919fc420e
ClearSky Lazarus Aug 2020ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1608.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--061c7b3d-775a-403f-9fd6-af0962a2e25e
McAfee Lazarus Nov 2020 · ESET Lazarus Jun 2020 · McAfee Lazarus Jul 2020 · ClearSky Lazarus Aug 2020ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--078fe5f7-91b4-4864-960a-24c64b14996e
ESET Lazarus Jun 2020 · McAfee Lazarus Jul 2020 · ClearSky Lazarus Aug 2020ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0eed42c5-98b2-409a-abaf-95915fc93d79
McAfee Lazarus Jul 2020ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1585.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--14fac9a8-f835-492b-b4df-32b677ac9030
ESET Lazarus Jun 2020 · ClearSky Lazarus Aug 2020ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1036.008
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--154d0730-b087-46ce-9ae2-b1a551ff4ab8
ESET Lazarus Jun 2020 · McAfee Lazarus Jul 2020ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--15e25965-b5e9-4b8c-b052-8a2233b30198
ESET Lazarus Jun 2020ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--16713b63-7fe7-41e0-b157-2d26a406881b
McAfee Lazarus Jul 2020ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1497.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1bbc2179-9302-4f21-98b8-b1f60ceafed3
ClearSky Lazarus Aug 2020ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1059.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1f6da45b-bf15-47d7-ab80-5c110b0f4d62
McAfee Lazarus Jul 2020 · ClearSky Lazarus Aug 2020ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1608.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--269bad6d-f72d-4deb-b125-7cb1e032efc8
ESET Lazarus Jun 2020ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--27b3c824-888f-4c03-8cf6-5235da956381
ESET Lazarus Jun 2020 · McAfee Lazarus Jul 2020 · ClearSky Lazarus Aug 2020ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1585.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2a13b64a-2173-4565-aca6-bbf3edfdc499
ESET Lazarus Jun 2020ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1584.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2c095f1e-211d-4e84-b521-9cef12f1e83f
McAfee Lazarus Nov 2020 · McAfee Lazarus Jul 2020ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1583.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--35fe4117-1f37-4968-8b9a-21ce4217516f
ESET Lazarus Jun 2020ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1573.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3658d2f3-25f5-404a-bf0b-7c5fce9978f6
McAfee Lazarus Jul 2020ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1204.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3c2b63fe-e891-4ac5-a0aa-d02536699614
ESET Lazarus Jun 2020 · ClearSky Lazarus Aug 2020ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--431f7f45-8955-48d3-948a-891ed2a59c3f
ESET Lazarus Jun 2020ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1591
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--44468587-67b5-4c44-8c2b-ed2b4769f055
ClearSky Lazarus Aug 2020ATTACK:enterprise:C0022 → attributed-to → ATTACK:enterprise:G0032
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4b66e057-adbc-498d-99ee-156e0d17bd53
McAfee Lazarus Nov 2020 · ESET Lazarus Jun 2020 · McAfee Lazarus Jul 2020 · ClearSky Lazarus Aug 2020ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1583.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4f590bfb-0436-4d8e-a5a1-5bd1dfcf350d
ESET Lazarus Jun 2020ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1221
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--55323dcc-68cb-4e92-bcf3-33c7d26f9b5e
McAfee Lazarus Jul 2020 · ClearSky Lazarus Aug 2020ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:S0678
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5687f6c6-f749-456e-a7fe-179017d50e9b
McAfee Lazarus Nov 2020 · McAfee Lazarus Jul 2020ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1497.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--57e7d8ef-33dd-4a08-bce2-e516a9662383
ClearSky Lazarus Aug 2020ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1589
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5e3036ee-9d90-4fbb-a435-ff6caf9d38c6
ClearSky Lazarus Aug 2020ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1553.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5e3c0815-5dc8-44a4-9dce-16bff49fb218
ESET Lazarus Jun 2020ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--61cfb178-a097-4788-a084-48d0d7c602b5
McAfee Lazarus Jul 2020 · ClearSky Lazarus Aug 2020ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1110
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--62192379-d052-4618-be33-8511d636c67c
ESET Lazarus Jun 2020ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6ddbec2b-2a42-476f-919d-da3e4b06a1e2
ClearSky Lazarus Aug 2020ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1534
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7064e494-5a32-4a40-b0b1-b19b9a145e73
ClearSky Lazarus Aug 2020ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1684.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--71db0201-9d27-4c74-a242-198dccbac5ad
ESET Lazarus Jun 2020 · ClearSky Lazarus Aug 2020 · The Hacker News Lazarus Aug 2022ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1583.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--78a7e89b-4560-4105-adfb-47393c39625b
ClearSky Lazarus Aug 2020ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1566.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--79cf4f25-6d05-4756-a671-2d578c6db184
ESET Lazarus Jun 2020 · ClearSky Lazarus Aug 2020ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1591.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7ab5eaf4-49de-4680-88f2-6d4c876934b8
ESET Lazarus Jun 2020 · ClearSky Lazarus Aug 2020ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7e12ea45-1adc-4c0c-95a7-68d5215760dc
ESET Lazarus Jun 2020ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7f74dcb1-6ce2-4247-8ea2-58caea335094
McAfee Lazarus Jul 2020 · ClearSky Lazarus Aug 2020ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1588.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8a78d2b1-e15c-4985-a1a4-fb2af9824f33
ESET Lazarus Jun 2020ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1087.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8f1bdb28-7941-4b76-bcf3-2fe73321f0c5
ESET Lazarus Jun 2020ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1587.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--96ff6190-cb11-4473-a194-abbf317205b8
ESET Lazarus Jun 2020ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1566.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--98c14ff6-0e71-4cfe-ae3f-bc8a7f0c5260
McAfee Lazarus Jul 2020 · ClearSky Lazarus Aug 2020ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:S0174
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9f6939de-be8d-45cc-8c2d-6a3c6972c2d2
ClearSky Lazarus Aug 2020ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1505.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a2c0d9fd-5ce9-4df1-8218-771b111bc1e4
McAfee Lazarus Jul 2020ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a5872314-732e-4896-a817-13986774d62c
ClearSky Lazarus Aug 2020ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1218.010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ae1592ae-15a3-45e3-a509-4fe9be3f9ed9
ESET Lazarus Jun 2020ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1047
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--afd3118f-bde5-4c02-8e82-045edec0dfdc
ESET Lazarus Jun 2020ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1027.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b01660bb-1725-42f4-9419-495b8710e930
McAfee Lazarus Nov 2020 · McAfee Lazarus Jul 2020 · ClearSky Lazarus Aug 2020ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b6f6b1e0-8e37-4f0a-b506-66537d3f0ff0
ESET Lazarus Jun 2020 · ClearSky Lazarus Aug 2020ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b7362262-2738-4d3f-a993-c116557a4eaa
McAfee Lazarus Jul 2020ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1567.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b8458076-fd1f-48e1-a637-57690c4fe59d
ESET Lazarus Jun 2020 · ClearSky Lazarus Aug 2020ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1622
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bcf36359-e8be-4842-8174-489a679f32a4
ClearSky Lazarus Aug 2020ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c3d73dc3-06f6-422a-9be2-c4eb3ce36fbc
McAfee Lazarus Nov 2020 · ESET Lazarus Jun 2020 · McAfee Lazarus Jul 2020 · ClearSky Lazarus Aug 2020ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1220
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c4ea56ee-ac98-40bd-a609-9c694fad391d
ESET Lazarus Jun 2020ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1587.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d1bd6ce6-eb5f-41a1-b26f-4fe0d83e51ea
McAfee Lazarus Nov 2020 · ESET Lazarus Jun 2020 · McAfee Lazarus Jul 2020 · ClearSky Lazarus Aug 2020ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e39b2ccc-79ee-4dee-a5e7-49f61d762ef4
ESET Lazarus Jun 2020 · McAfee Lazarus Jul 2020ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:S0694
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ef2cc201-0b82-41a9-98fd-1eda4fb79b39
ClearSky Lazarus Aug 2020ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1584.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f5c80a6c-8bbe-449d-80fb-8c5d7035d25d
ESET Lazarus Jun 2020 · McAfee Lazarus Jul 2020 · ClearSky Lazarus Aug 2020ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1593.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f73d269a-9a0d-4485-9587-e0f0f2335c35
ESET Lazarus Jun 2020ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f998689d-ce01-4ece-87a0-906255177e55
ESET Lazarus Jun 2020 · ClearSky Lazarus Aug 2020ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1560.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fc62ec8c-5015-4f02-b9b6-3964082d101d
ESET Lazarus Jun 2020