On 28 October 2026, security company ESET published its APT Activity Report for April to September 2026. Three findings stand out for anyone who designs products: North Korea's Lazarus group restarted its fake job offer campaign against drone and defence suppliers around June, a related North Korean group moved from fake job interviews to poisoning developers' code repositories, and a Belarus-aligned group wiped the computers of a Ukrainian manufacturer, the first destructive attack ESET has documented from that side.
None of this is about SOLIDWORKS as software. ESET does not mention CAD tools, and no SOLIDWORKS flaw is involved. But the people these groups go after look a lot like the readers of this blog: engineers at component makers and OEMs, often in small and mid-sized companies, who hold drawings, models and manufacturing know-how that a state wants and cannot easily develop itself.
The methods are familiar too: a friendly recruiter, a PDF that needs a special viewer, a handy plugin, a Group Policy change that reaches every workstation at once. Here is what ESET found and what SOLIDWORKS teams should do this month.
TL;DR: state-backed groups are using job offers, trojanized tools and developer accounts to reach engineering know-how, and one of them wiped a manufacturer
ESET says Lazarus restarted Operation DreamJob against drone technology around June 2026 and has targeted many defence companies, mostly in Europe, that are OEMs or hold a top-tier position in the drone supply chain. One Central European defence company received a fake job description that could only be opened with a trojanized PDF viewer. A second North Korean group, DeceptiveDevelopment, now uses stolen Git credentials and tokens to plant malicious code in its victims' own repositories. And in late May, the Belarus-aligned FrostyNeighbor group pushed a wiper through Group Policy at a Ukrainian manufacturing company. For SOLIDWORKS teams, the steps are practical: treat unsolicited job offers as a security event, install only approved viewers, plugins and add-ins, protect the tokens behind your macros and PDM scripts, watch Group Policy changes and keep backups and dated proof of your designs where a domain admin cannot erase them.
What did ESET report on 28 October 2026?
The ESET APT Activity Report Q2 2026-Q3 2026 summarises what the company's researchers saw from state-aligned hacking groups between April and September 2026, based mostly on ESET's own telemetry. Most of it is about governments and the war in Ukraine, but several sections deal directly with companies that design and make things.
The parts that matter most for engineering and manufacturing:
- Lazarus is back on drones. After a quiet period following ESET's October 2025 write-up, Operation DreamJob restarted cyberespionage against drone technology and related supply chains around June 2026. ESET says there is "little doubt" that Lazarus has targeted many defence companies, mostly in Europe, that are original equipment manufacturers or sit near the top of the drone supply chain.
- Job interviews became a supply-chain attack. DeceptiveDevelopment, another North Korea-aligned group, now uses credentials stolen through fake job interviews to inject malicious code into its victims' repositories, sometimes rewriting the commit history to hide it.
- A first wiper from Belarus. In late May, FrostyNeighbor (also tracked as UNC1151 and Storm-0257) deployed remote access tools and then a wiper via Group Policy against a Ukrainian manufacturer that plays a significant role in the country's transportation sector.
- Semiconductor espionage continues. China-aligned groups targeted Taiwanese companies in the semiconductor supply chain, including a chemicals supplier whose outdated public-facing application was compromised in June.
How does the fake job offer attack work?
Operation DreamJob has run since at least 2019, and its basic trick has not changed: a recruiter contacts an engineer with an attractive role at a well-known aerospace or defence company, builds trust over a few messages and then sends a job description. The attack is in the file and in the tool that comes with it.
In one attack ESET saw against a defence company in Central Europe, an employee received a password-protected ZIP archive. Inside was a PDF themed around BAE Systems, deliberately built with a broken file header so that normal PDF readers would not open it, plus a trojanized copy of the free SumatraPDF viewer made to open exactly that file. The employee sees a plausible job description. In the background, the attackers get a foothold.
ESET also notes a change of tools. In 2025, the group hid its loader in trojanized WinMerge plugins. In 2026, it switched to two trojanized Notepad++ plugins, which ESET calls MortPusLoader. The final payload was either the ScoringMathTea remote access trojan or LightlessTeaR, a stealthier rewrite of an older Lazarus tool. The command servers ran on hacked webmail servers of universities and government bodies in South America.
For a SOLIDWORKS team, the uncomfortable part is how ordinary all of this looks. Engineers install viewers, file comparison tools, text editor plugins, macros and add-ins all the time, often without asking anyone. Our guides to how SOLIDWORKS plugins access your CAD files and checking AI-written SOLIDWORKS macros before you run them explain why anything that runs on an engineering workstation can read everything that engineer can open.
Why do poisoned repositories matter to CAD teams?
DeceptiveDevelopment usually goes after software developers, often in cryptocurrency, with fake coding tests. ESET's new finding is what happens next. Once a developer runs the test, the malware collects Git credentials, SSH keys and access tokens. The attackers then use them to push malicious code into the victim's own repositories, and that code spreads through npm, PyPI, Packagist, the Go module mirror and browser extension stores to everyone downstream.
Most affected projects were small utilities maintained by one person. ESET also found malware that adds itself to VS Code, Cursor and Discord so it runs every time the developer opens them.
Many SOLIDWORKS teams now have a small software side: VBA and C# macros, PDM add-ins and dispatch scripts, export tools, configurators and API integrations with ERP. That code often lives in a Git repository maintained by one engineer, and it often holds credentials for the PDM vault, a file share or a cloud tenant. Our article on SOLIDWORKS API security covers the basics. The ESET report is a reminder that the person who maintains that repository is a target in their own right.
What happened at the Ukrainian manufacturer?
In late May 2026, FrostyNeighbor deployed the tunnelling tool Chisel, the UltraVNC remote desktop tool and Cobalt Strike at a Ukrainian manufacturing company, and finally a VBScript wiper distributed via Group Policy. In ESET's words: "To the best of our knowledge, this marks the very first documented instance of a Belarus-aligned threat actor conducting a destructive cyberattack."
ESET does not name the company or say what data was lost, and it gives no count of victims for any of these campaigns. It says the wiper may have been used to cover the tracks of an espionage operation. Either way, the method matters: an attacker who controls Group Policy can push a destructive script to every domain-joined machine at once, including CAD workstations, the PDM server and any backup server that trusts the same domain.
That is the same lesson as this week's Synology NAS ransomware attacks: a backup that the attacker's account can reach is not a backup. Our list of common SOLIDWORKS PDM security mistakes is a good checklist for the vault itself.
Which ESET findings map to which SOLIDWORKS risk?
The groups in the report were not targeting SOLIDWORKS. But each method has a direct equivalent in a typical CAD department:
Keep proof of your SOLIDWORKS designs that no wiper can erase.
BORIS for SOLIDWORKS registers your CAD files with a blockchain timestamp and a certificate of ownership from inside SOLIDWORKS. The record of what you designed and when sits outside your network, so it survives a wiped domain, a leak or a stolen laptop.
👉 Get BORIS for SOLIDWORKS
Which SOLIDWORKS teams should take this most seriously?
ESET says Lazarus focused on companies that are OEMs or top-tier suppliers in the drone supply chain. In practice, that circle is wide: frames and housings, motors and gimbals, sensors, cable harnesses, machined and printed parts, test rigs. Many of those parts are designed in SOLIDWORKS by small companies that do not think of themselves as defence contractors. Our overview of CAD security in the defence industry is a good place to start.
If your designs fall under export controls, a foothold on an engineer's laptop is also a compliance problem, not just a security one. See our guides to export control rules for CAD files and ITAR compliance for SOLIDWORKS users. And if you share models with customers and sub-suppliers, our guide to supplier collaboration security covers the sharing side.
The pattern fits what we have seen in recent weeks. The Ivanti VPN zero-days opened a path from the network edge to PDM vaults, and the Helix group used phone calls and device codes to pull files from SharePoint. Attackers keep choosing the route that a busy engineer or IT admin is least likely to question.
Did AI change these attacks?
Less than the headlines suggest. ESET saw state groups use AI to speed up malware development and build decoy websites, AI-generated images in phishing lures and one Russia-aligned group that hid a request for nuclear weapon instructions in a script comment, apparently to make AI-based security tools refuse to analyse the code. But ESET's summary is sober: "Despite these developments, we have not noticed AI substantially reshaping the APT landscape over the past six months."
What should SOLIDWORKS teams do now?
- Treat unsolicited job offers as a security event. Tell engineers that recruiters who send files, tests or special viewers are a known attack, and give them one place to report such messages without embarrassment.
- Keep job hunting off work devices. No interview tasks, coding tests or job descriptions on machines that hold design data or have VPN access to the vault.
- Install only approved viewers, plugins and add-ins. Keep a short list for SOLIDWORKS add-ins, macros, PDF viewers, text editors and comparison tools, download them from the vendor and remove what nobody uses.
- Protect the secrets behind your automation. Move passwords and tokens for PDM, file shares and cloud tenants out of macro and script repositories, use multi-factor sign-in for Git hosting and review who can push code.
- Watch Group Policy and admin accounts. Alert on new or changed Group Policy objects and new domain admins, and separate admin accounts from everyday engineering accounts.
- Keep backups the domain cannot delete. Store at least one copy of CAD data and PDM backups offline or as immutable storage with separate credentials, and test a restore of a full assembly.
- Patch what faces the internet. Supplier portals, configurators, remote access gateways and file transfer tools come first.
- Keep dated proof of key designs. Timestamp native SOLIDWORKS files when they reach a milestone, so you can show what you had and when if a copy turns up elsewhere.
Why does proof of ownership matter after espionage?
Espionage is quiet. A company may never learn that its models were copied until a similar part appears in a competitor's catalogue or in a battlefield photo. At that point, the questions are legal: was this information a trade secret, did you take reasonable steps to protect it and can you prove when you created it? Our guides to trade secret protection for CAD files and blockchain timestamping as first-in-time proof explain the background.
How does this fit the bigger picture for CAD users?
Across our network this week, the theme is trust: in network gear, in certificates and in the rules for training AI on other people's work.
- Espionage in the network itself. CADChain looks at KeyDrift malware on Cisco Catalyst SD-WAN, which Cisco Talos says targeted space, defence and aerospace organisations and captured key material used to encrypt their traffic.
- Broken trust in certificates. BORIS Inventor explains the eMudhra certificate authority compromise and the updates Microsoft shipped to remove the affected roots from Windows machines.
- AI training on creative work. Blended BORIS covers the wave of amicus briefs in the OpenAI copyright case, where AI companies, photographers and artists argue over fair use.
Conclusion
ESET's latest report shows state-backed groups going after the knowledge that sits in engineering departments, especially in the drone and defence supply chain. They do it with fake job offers, trojanized everyday tools and stolen developer access, and at least one of them was willing to wipe a manufacturer's network.
None of these attacks needs a SOLIDWORKS vulnerability. They need an engineer who trusts a recruiter, a workstation where anyone can install a plugin, a repository full of tokens or a backup that the domain admin can delete. Those are fixable this month, and fixing them protects your designs whoever is behind the next attack.
Make your SOLIDWORKS designs provably yours, wherever the files end up.
BORIS for SOLIDWORKS adds blockchain timestamps and certificates of ownership to your CAD files from inside SOLIDWORKS, so you keep independent proof of what you designed and when, even after espionage, a wiper or a leak.
👉 Get BORIS for SOLIDWORKS
FAQ: the ESET APT report and SOLIDWORKS teams
Is SOLIDWORKS vulnerable to the attacks in the ESET report?
No SOLIDWORKS vulnerability is involved. ESET describes social engineering, trojanized third-party tools, stolen developer credentials and a wiper pushed through Group Policy. SOLIDWORKS data is at risk because it sits on the computers and networks these methods reach.
What is Operation DreamJob?
It is a long-running North Korean Lazarus campaign that uses fake job offers to reach engineers in aerospace and defence. ESET says it restarted against drone technology and related supply chains around June 2026.
How can engineers spot a fake recruiter?
Warning signs include an unsolicited offer at a famous company, pressure to move to a private chat, and files that come in password-protected archives or need a special viewer or tool to open. A real recruiter does not need you to install software.
Does a wiper attack affect SOLIDWORKS PDM?
It can. A wiper distributed through Group Policy can reach every domain-joined machine, including the PDM archive and database servers and backup servers in the same domain. Keep at least one backup copy offline or immutable, with separate credentials.
Did AI make these attacks more dangerous?
ESET saw AI used to speed up malware development and create decoy websites and lure images, but says it has not noticed AI substantially reshaping state-backed attacks over the past six months.
How does BORIS for SOLIDWORKS help?
It does not block malware or replace backups. It gives your SOLIDWORKS files blockchain-timestamped certificates of ownership stored outside your network, so you can prove what you designed and when if files are copied or destroyed.