Faux Job Lures Goal Staff of Aerospace, Power Corporations

A North Korean cyberespionage group is posing as job recruiters and targeting aerospace and energy sector employees with lucrative job offers, according to Mandiant. The hackers use email and WhatsApp messages to lure victims into clicking a link that deploys backdoor malware onto their devices.

See Also: 2024 APJ State of the Phish: Is Your Organisation Covered

In a Wednesday weblog submit, Mandiant said that it investigated a number of makes an attempt by a North Korean cyberespionage group in June to focus on individuals working in aerospace and vitality firms, together with these at BAE Programs, a British multinational aerospace and protection producer that additionally supplies info safety companies.

Mandiant mentioned the group initially contacted victims by e mail after which moved the dialog to WhatsApp, the place they despatched detailed job descriptions tailor-made to every individual’s particular position. The job descriptions have been in PDF format, saved inside a malicious archive, and will solely be opened with a Trojanized model of SumatraPDF included within the archive.

The group, which Mandiant tracks as UNC2970, has routinely focused organizations and their staff throughout sectors to acquire info of curiosity to the Kim Jong Un-led regime. Mandiant mentioned the group’s instruments and assault methods are just like one other North Korean menace group, tracked as TEMP.Hermit, which has been engaged in strategic intelligence assortment since at the very least 2013.

North Korean actors have beforehand used LinkedIn for job-related phishing lures. In March 2023, Mandiant mentioned the UNC2970 group masqueraded as recruiters for The New York Occasions and different U.S. and European media organizations and tried to get victims to open a phishing payload disguised as a job description or expertise evaluation (see: North Korean Hackers Find Value in LinkedIn).

Within the June marketing campaign, the espionage group used older variations of SumatraPDF, a free and open-source doc viewer, to ship backdoor malware known as MISTPEN, which is a modified model of a Notepad++ plug-in. The hackers didn’t exploit any vulnerabilities in SumatraPDF however added a thread to its DllMain operate to execute malicious code.

The group additionally modified a authentic DLL file utilized by the SumatraPDF binary to create a launcher known as BURNBOOK. “This file is a dropper for an embedded DLL, “wtsapi32.dll,” which is tracked as TEARPAGE and used to execute the MISTPEN backdoor after the system reboots,” Mandiant mentioned. Newer variations of SumatraPDF now stop customers from loading modified variations of the authentic DLL, forcing the menace group to make use of older variations of the doc reader.

North Korean espionage assaults on Western organizations and rival nations in East Asia have escalated lately, significantly after Kim Jong Un introduced plans to modernize the hermit kingdom’s navy and industrial belongings.

In June, South Korea’s Nationwide Intelligence Service and the Nationwide Police Company, the U.Ok.’s Nationwide Cyber Safety Heart, the U.S. Cybersecurity and Infrastructure Safety Company and the FBI warned in a joint advisory that the North Korean espionage group Andariel was focusing on the protection, aerospace and vitality sectors to steal Western nuclear and navy applied sciences to advance the regime’s navy and nuclear ambitions (see: Agencies Warn of North Korean Hacks on Nuclear Installations).

The group, often known as Onyx Sleet, DarkSeoul, Silent Chollima and Stonefly, primarily targets Western and allied protection, aerospace, nuclear and engineering organizations. It funds its operations via ransomware assaults on U.S. healthcare establishments, the businesses mentioned.

Although Mandiant didn’t hyperlink any UNC2970 operation with Andariel, researchers mentioned North Korean hacker teams routinely share cyberattack instruments and techniques relying on their targets. “[UNC2970] has vital malware overlaps with different North Korean operators and is believed to share assets, reminiscent of code and full malware instruments, with different distinct actors,” the corporate mentioned. “Whereas noticed UNC577 exercise primarily targets entities in South Korea, it has additionally focused different organizations worldwide.”