During Operation Dream Job, Lazarus Group used malicious Trojans and DLL files to exfiltrate data from an infected host.56
campaign
Operation Dream Job C0022
- First seen
- September 2019
- Last seen
- August 2020
- Created
- 17 March 2023
- Last modified
- 31 July 2026
Operation Dream Job was a cyber espionage operation likely conducted by Lazarus Group that targeted the defense, aerospace, government, and other sectors in the United States, Israel, Australia, Russia, and India. In at least one case, the cyber actors tried to monetize their network access to conduct a business email compromise (BEC) operation. In 2020, security researchers noted overlapping TTPs, to include fake job lures and code similarities, between Operation Dream Job, Operation North Star, and Operation Interception; by 2022 security researchers described Operation Dream Job as an umbrella term covering both Operation Interception and Operation North Star.[1][2][3][4]
55
TechniquesTop 4%
14
TacticsTop 4%
3
Tools & malware66th pct
1
Threat groupunranked
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
MITRE reference C0022
During Operation Dream Job, Lazarus Group packed malicious .db files with Themida to evade detection.789
During Operation Dream Job, Lazarus Group encrypted malware such as DRATzarus with XOR and DLL files with base64.10111213
During Operation Dream Job, Lazarus Group disguised malicious template files as JPEG files to avoid detection.1415
During Operation Dream Job, Lazarus Group exfiltrated data from a compromised host to actor-controlled C2 servers.16
During Operation Dream Job, Lazarus Group used WMIC to executed a remote XSL script.17
Standing C0022
Reach is how much of ATT&CK this campaign touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 56 ATT&CK campaigns only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
Reach
Techniques55Top 4%
96th percentile · 96% of 56 ATT&CK campaigns have this many Enterprise techniques or fewer.
Tactics14Top 4%
96th percentile · 96% of 56 ATT&CK campaigns have this many tactics spanned or fewer.
Tools & malware366th pct
66th percentile · 66% of 56 ATT&CK campaigns have this many tools and malware or fewer.
Threat group155% tie · 3 values
55% of the population shares a single value across only 3 distinct values, so a percentile here would rank the tie, not the entity.
Coverage
Rules / technique4medBottom 9%
9th percentile · 91% of 56 ATT&CK campaigns have more detection rules per technique.
Tests / technique1med
Detection coverage C0022
1189 distinct rules cover the 55 techniques recorded for this campaign. The 1339 technique-to-rule mappings resolve to 1189 distinct rules, because one rule can cover several techniques. 814 Sigma · 375 Splunk.
42 covered by at least one rule13 with no coverage1189 distinct rules in total
tf
Loading...Drag headers to reorder | Drag edges to resize
tf
Loading detections...
| Select | Title | Description | Category | Status | Event | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
© 2026 The MITRE Corporation. ATT&CK® and D3FEND™ data reproduced with permission. SigmaHQ detection rules licensed under DRL 1.1. attack.mitre.org · d3fend.mitre.org · CAR analytics licensed under Apache 2.0 · car.mitre.org