The so-called "Dream Job" campaign has been active since at least Sept. 2023, with the goal of phishing people working in the aerospace, aviation, and defense industries. “This suggests a strategic interest in acquiring sensitive information and potentially disrupting operations within these critical sectors,” Clear Sky said in its report.

"The campaign distributed the SnailResin malware, which activates the SlugResin backdoor," Israeli cybersecurity company ClearSky said in a Tuesday analysis. TA455, also tracked by Google-owned Mandiant as UNC1549 and Yellow Dev 13,