An Iranian threat group appears to have borrowed from the playbook of North Korean cybercriminals for a campaign targeting the aerospace industry, a development that researchers say may point to collusion between the state-backed actors.

TA455, a subgroup of Iran’s state-sponsored APT35 cyberwarfare unit (also known as “Charming Kitten”), used fake job offers to lure unsuspecting targets into installing its signature SnailResin malware loader, Israeli cybersecurity firm ClearSky stated in a report on Tuesday.

Researchers called this operation the Iranian “Dream Job” campaign, a reference to the Pyongyang-backed Lazarus Group’s fake recruitment scheme