campaign

Operation Dream Job C0022

First seen: September 2019
Last seen: August 2020
Created: 17 March 2023
Last modified: 31 July 2026

Operation Dream Job was a cyber espionage operation likely conducted by Lazarus Group that targeted the defense, aerospace, government, and other sectors in the United States, Israel, Australia, Russia, and India. In at least one case, the cyber actors tried to monetize their network access to conduct a business email compromise (BEC) operation. In 2020, security researchers noted overlapping TTPs, to include fake job lures and code similarities, between Operation Dream Job, Operation North Star, and Operation Interception; by 2022 security researchers described Operation Dream Job as an umbrella term covering both Operation Interception and Operation North Star.[1][2][3][4]

TechniquesTop 4%

TacticsTop 4%

Tools & malware66th pct

Threat groupunranked

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
Splunk	The following analytic detects the execution of 7z or 7za processes with command lines pointing to SMB network shares. (...)	Hunting	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Collection Archive Collected Data Archive via Utility	-	medium	Teoderick Contreras, Splunk	2021-08-17	2026-05-13	01d29b48-ff6f-11eb-b81e-acde48001123
	Detects execution of 7z in order to compress a file with a ".dmp"/".dump" extension, which could be a step in a process of dump file exfiltration.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Archive Collected Data Archive via Utility	-	medium	Nasreddine Bencherchali (Nextron Systems)	2022-09-27	2026-06-05	ec570e53-4c76-45a9-804d-dc3f355ff7a7
	Identifies user account which has been locked because the user tried to sign in too many times with an incorrect user ID or password.	Generic	test	authentication	-	Azure Sign-in Logs · Azure	Credential Access Brute Force	-	medium	AlertIQ	2021-10-10	2022-12-25	2b7d6fc0-71ac-4cf7-8ed1-b5788ee5257a
	Detects usage of the "Get-AdComputer" to enumerate Computers or properties within Active Directory.	Generic	test	ps_script	windows	PowerShell	Discovery Account Discovery Domain Account Discovery Remote System Discovery	-	low	frack113	2022-03-17	2023-07-08	36bed6b2-e9a0-4fff-beeb-413a92b86138
	Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag in order to save a local copy of the active directory database. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Domain Groups	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-03-14	2025-07-09	9212f354-7775-4e28-9c9f-8f0a4544e664
	Detects the execution of "csvde.exe" in order to export organizational Active Directory structure.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Domain Account	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-03-14	—	e5d36acd-acb4-4c6f-a13f-9eb203d50099
	Detect priv users or groups recon based on 4661 eventid and known privileged users or groups SIDs	Generic	test	-	windows	WinEventLog Security	Discovery Account Discovery Domain Account	-	high	Samir Bousseaden	2019-04-03	2022-07-13	35ba1d85-724d-42a3-889f-2e2362bcaf23
	Detects the dual use tool ADExplorer writing a complete AD snapshot into a .dat file. (...)	Generic	experimental	file_event	windows	Sysmon	Discovery Account Discovery Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Domain Groups	-	medium	Arnim Rupp (Nextron Systems), Thomas Patzke	2025-07-09	—	0a1255c5-d732-4b62-ac02-b5152d34fb83
	Detects suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database). (...)	Generic	test	pipe_created	windows	Sysmon	Collection Data from Local System	-	medium	Roberto Rodriguez @Cyb3rWard0g	2021-10-08	2023-11-30	1ea13e8c-03ea-409b-877d-ce5c3d2c1cb3
	Detects the deletion of the "Zone.Identifier" ADS. (...)	Hunting	test	file_delete	windows	Sysmon	Stealth Indicator Removal File Deletion	-	low	frack113	2023-09-04	—	7eac0a16-5832-4e81-865f-0268a6d19e4b
	Detects the deletion of the "Zone.Identifier" ADS by an uncommon process. (...)	Generic	test	file_delete	windows	Sysmon	Stealth Indicator Removal File Deletion	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-09-04	2025-07-04	3109530e-ab47-4cc6-a953-cac5ebcc93ae
Splunk	The following analytic detects the use of the `[Adsisearcher]` type accelerator in PowerShell to query Active Directory for domain users. (...)	Generic	stable	ps_script	windows	PowerShell	Discovery Account Discovery Domain Account	-	medium	Teoderick Contreras, Mauricio Velazco, Splunk	2021-08-25	2026-10-02	de7fcadc-04f3-11ec-a241-acde48001122
	Detects javaw.exe in AppData folder as used by Adwind / JRAT	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Visual Basic JavaScript	-	high	Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community	2017-11-10	2022-10-09	1fac1481-2dbc-48b2-9096-753c49b4ec71
	Detects javaw.exe in AppData folder as used by Adwind / JRAT	Generic	test	file_event	windows	Sysmon	Execution Command and Scripting Interpreter Visual Basic JavaScript	-	high	Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community	2017-11-10	2022-12-02	0bcfabcb-7929-47f4-93d6-b33fb67d34d1
	Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe	Generic	test	ps_module	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell	-	medium	Roberto Rodriguez @Cyb3rWard0g	2019-08-11	2025-10-17	64e8e417-c19a-475a-8d19-98ea705394cc
	Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe	Generic	test	pipe_created	windows	Sysmon	Execution Command and Scripting Interpreter PowerShell	-	medium	Roberto Rodriguez @Cyb3rWard0g, Tim Shelton	2019-09-12	2025-10-07	58cb02d5-78ce-4692-b3e1-dce850aae41a
Splunk	The following analytic detects the execution of 7z.exe, a 7-Zip utility, spawned from rundll32.exe or dllhost.exe. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Collection Archive Collected Data Archive via Utility	-	medium	Michael Haag, Teoderick Contreras, Splunk	2021-04-22	2026-05-13	9364ee8e-a39a-11eb-8f1d-acde48001122
	Detects the removal or uninstallation of an application via "Wmic.EXE".	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Windows Management Instrumentation	-	medium	frack113	2022-01-28	2024-07-02	b53317a0-8acf-4fd1-8de8-a5401e776b96
	Detects an attempt to terminate a process via "wmic" with the "call terminate" flag. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Windows Management Instrumentation	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-09-11	—	49d9671b-0a0a-4c09-8280-d215bfd30662
	Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.	Generic	experimental	-	windows	AppLocker	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Python Execution User Execution Malicious File	-	medium	heyyanu	2026-03-26	—	557e3bd3-7f21-495d-8d50-7c8bdfb8041c
	Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.	Generic	test	-	windows	AppLocker	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Python Execution User Execution Malicious File	-	medium	Pushkarev Dmitry	2020-06-28	2025-12-03	401e5d00-b944-11ea-8f9a-00163ecd60ae
	Detects DNS queries made by "AppInstaller.EXE". (...)	Generic	test	dns	windows	Sysmon	Command and Control Ingress Tool Transfer	-	medium	frack113	2021-11-24	2023-11-09	7cff77e1-9663-46a3-8260-17f2e1aa9d0a
	Detects suspicious user agent strings used in APT malware in proxy logs	Generic	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols	-	high	Florian Roth (Nextron Systems), Markus Neis	2019-11-12	2024-02-15	6ec820f2-e963-4801-9127-d8b2dce4d31b
	Detects indicators of APT 29 (Cozy Bear) phishing-campaign as reported by mandiant	Emerging	stable	process_creation	windows	Sysmon · WinEventLog Security	Stealth System Binary Proxy Execution Rundll32	-	critical	Florian Roth (Nextron Systems), @41thexplorer	2018-11-20	2023-03-08	7453575c-a747-40b9-839b-125a0aae324b
	Detects indicators of APT 29 (Cozy Bear) phishing-campaign as reported by mandiant	Emerging	stable	file_event	windows	Sysmon	Stealth System Binary Proxy Execution Rundll32	-	critical	@41thexplorer	2018-11-20	2023-02-20	3a3f81ca-652c-482b-adeb-b1c804727f74
	Detects APT31 Judgement Panda activity as described in the Crowdstrike 2019 Global Threat Report	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Archive Collected Data Archive via Utility Credential Access OS Credential Dumping LSASS Memory	-	critical	Florian Roth (Nextron Systems)	2019-02-21	2023-03-10	03e2746e-2b31-42f1-ab7a-eb39365b2422
	Detects suspicious user agent string of APT40 Dropbox tool	Emerging	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols Exfiltration Exfiltration Over Web Service Exfiltration to Cloud Storage	-	high	Thomas Patzke	2019-11-12	2023-05-18	5ba715b6-71b7-44fd-8245-f66893e81b3d
	Detects execution of GfxDownloadWrapper.exe with a URL as an argument to download file.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Ingress Tool Transfer	-	medium	Victor Sergeev, oscd.community	2020-10-09	2023-10-18	eee00933-a761-4cd0-be70-c42fe91731e7
	The .SettingContent-ms file type was introduced in Windows 10 and allows a user to create "shortcuts" to various Windows 10 setting pages. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Initial Access Phishing Spearphishing Attachment Execution User Execution	-	medium	Sreeman	2020-03-13	2022-04-14	24de4f3b-804c-4165-b442-5a06a2302c7e
Splunk	The following analytic detects the resetting of the master user password for an Amazon RDS DB instance. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Credential Access Brute Force Resource Development Compromise Accounts Cloud Accounts	-	medium	Patrick Bareiss, Splunk	2022-08-07	2026-05-13	d15e9bd9-ef64-4d84-bc04-f62955a9fee8
Splunk	The following analytic detects multiple failed attempts to assume an AWS IAM role, indicating a potential brute force attack. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Credential Access Brute Force Discovery Cloud Infrastructure Discovery	-	medium	Patrick Bareiss, Splunk	2022-10-04	2026-05-13	726959fe-316d-445c-a584-fa187d64e295
	Detects automated lateral movement by Turla group	Unsupported	unsupported	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Discovery File and Directory Discovery Discovery Network Share Discovery Lateral Movement Remote Services SMB/Windows Admin Shares	-	medium	Markus Neis	2017-11-07	2023-02-24	75925535-ca97-4e0a-a850-00b5c00779dc
	Detects failed AWS console login attempts due to authentication failures. (...)	Generic	experimental	cloud_audit	-	AWS CloudTrail · AWS	Credential Access Brute Force	-	medium	Ivan Saakov, Nasreddine Bencherchali	2025-10-19	—	6393e346-1977-46ef-8987-ad414a145fad
Splunk	The following analytic detects the resetting of the master user password for an Amazon RDS DB instance. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Credential Access Brute Force Resource Development Compromise Accounts Cloud Accounts	-	medium	Gowthamaraj Rajendran, Splunk	2022-08-07	2026-05-13	6153c5ea-ed30-4878-81e6-21ecdb198189
	Detects changes to the EC2 instance startup script. (...)	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Unix Shell	-	high	faloker	2020-02-12	2022-06-07	1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df
	An attempt to export an AWS EC2 instance has been detected. (...)	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Collection Data from Local System Exfiltration Transfer Data to Cloud Account	-	low	Diogo Braz	2020-04-16	2022-10-05	54b9a76a-3c71-4673-b4b3-2edb4566ea7b
Splunk	The following analytic detects multiple failed attempts to assume an AWS IAM role, indicating a potential brute force attack. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Credential Access Brute Force Discovery Cloud Infrastructure Discovery	-	medium	Michael Haag, Splunk	2021-04-06	2026-05-13	f19e09b0-9308-11eb-b7ec-acde48001122
	Detects file creation events linked to the Axios NPM supply chain compromise. (...)	Emerging	experimental	file_event	linux	Sysmon	Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	b7cb840c-11f6-47f7-b3ef-5524739c9077
	Detects file creation events linked to the Axios NPM supply chain compromise on macOS devices. (...)	Emerging	experimental	file_event	macos	-	Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	2db0458c-05c9-4069-a26f-77becd9c8c13
	Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3. (...)	Emerging	experimental	process_creation	linux	Sysmon	Execution Command and Scripting Interpreter Unix Shell Python Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	0a23a62d-c5b3-468b-a072-25064a9a8c87
	Detects the macOS-specific execution chain of the plain-crypto-js malicious npm dependency in Axios NPM Package, including AppleScript execution via osascript, payload download, permission modification, execution, and cleanup.	Emerging	experimental	process_creation	macos	-	Execution Command and Scripting Interpreter AppleScript Unix Shell Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	a09ee860-31b3-4586-8a68-0ebd74ce0e5f
	Detects the specific Windows execution chain and process tree associated with the Axios NPM supply chain compromise. (...)	Emerging	experimental	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell Visual Basic Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	f6c27ecc-d890-4452-80e6-2e274a10e097
	Detects DNS queries for the malicious C2 domain associated with the plain-crypto-js/Axios npm package supply chain compromise. (...)	Emerging	experimental	dns	-	-	Command and Control Application Layer Protocol Web Protocols Command and Control Dynamic Resolution	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	73e5d24f-493f-4092-bd2f-c72cabda40ee
	Indicates that the user's valid credentials have been leaked.	Generic	test	-	-	Azure Risk Detection · Azure	Reconnaissance Gather Victim Identity Information	-	high	Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'	2023-09-03	—	19128e5e-4743-48dc-bd97-52e5775af817
Splunk	The following analytic identifies Azure Device Code Phishing attacks, which can lead to Azure Account Take-Over (ATO). (...)	Generic	stable	authentication	-	Microsoft 365	Initial Access Phishing Spearphishing Link Credential Access Steal Application Access Token	-	medium	Mauricio Velazco, Gowthamaraj Rajendran, Splunk	2023-11-16	2026-05-13	d68d8732-6f7e-4ee5-a6eb-737f2b990b91
	Detects backup catalog deletions	Generic	test	-	windows	WinEventLog Application	Stealth Indicator Removal File Deletion	-	medium	Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection)	2017-05-12	2022-12-25	9703792d-fd9a-456d-a672-ff92efe4806a
	Detects attackers using tooling with bad opsec defaults. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth System Binary Proxy Execution Rundll32	-	high	Oleg Kolesnikov @securonix invrep_de, oscd.community, Florian Roth (Nextron Systems), Christian Burkard (Nextron Systems)	2020-10-23	2024-08-15	a7c3d773-caef-227e-a7e7-c2f13c622329
	focuses on trivial artifacts observed in variants of prevalent offensive ps1 payloads, including Cob (...)	Generic	test	ps_module	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell	-	critical	ok @securonix invrep_de, oscd.community	2020-10-09	2022-12-25	8d31a8ce-46b5-4dd6-bdc3-680931f1db86
	Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Deobfuscate/Decode Files or Information Stealth Obfuscated Files or Information	-	high	Florian Roth (Nextron Systems)	2020-01-29	2023-01-26	e32d4572-9826-4738-b651-95fa63747e8a
Splunk	The following analytic detects the creation of a batch file (.bat) within the Windows system directory tree, specifically in the System32 or SysWOW64 folders. (...)	Anomaly	stable	file_event	windows	Sysmon	Execution User Execution Malicious File	-	medium	Steven Dick, Michael Haag, Rico Valdez, Splunk	2020-04-29	2026-07-02	503d17cb-9eab-4cf8-a20e-01d5c6987ae3	-

Title

Description

Operation Dream Job C0022

Operation Dream Job C0022

Operation Dream Job MITRE reference C0022

Operation Dream Job MITRE reference C0022

Standing C0022

Reach

Coverage

Operation Dream Job detections C0022