Espionage Campaign Targeted Aerospace, Military Firms With Malware

guest · Jun 17, 2020

LinkedIn ‘Job Offers’ Targeted Aerospace, Military Firms With Malware
June 17, 2020
https://threatpost.com/linkedin-job-offers-targeted-aerospace-military-firms-with-malware/156614/

Attackers are impersonating human resource employees from Collins Aerospace and General Dynamics in a spear-phishing campaign leveraging LinkedIn’s messaging service. Targets are sent phony job offers that include malicious documents designed to fetch data-exfiltrating malware.

The spear-phishing messages were part of a widespread campaign, dubbed “Operation In(ter)ception,” which targeted victims at European and Middle East aerospace and military companies.
The cyberattacks “were highly targeted and relied on social engineering over LinkedIn and custom, multistage malware,” said researchers with ESET in a Wednesday analysis, shared at ESET Virtual World 2020.
Click to expand...

The “job offer” file was a password-protected RAR archive containing a LNK file. Once opened, the messages contained a seemingly-innocuous PDF document that showed salary information related to the fake job.

“Based on the job titles of the employees initially targeted via LinkedIn, it appears that Operation In(ter)ception targeted technical and business-related information,” said researchers.
Click to expand...

ESET: Operation In(ter)ception: Aerospace and military companies in the crosshairs of cyberspies

ESET researchers uncover targeted attacks against high-profile aerospace and military companies
Click to expand...

guest · Jun 17, 2020

...and BEC scams:

North Korea's state hackers caught engaging in BEC scams
June 17, 2020
https://www.zdnet.com/article/north-koreas-state-hackers-caught-engaging-in-bec-scams/

Codenamed "Operation In(ter)ception," this campaign targeted victims for both cyber-espionage and financial theft.

Speaking in a live stream to an audience of thousands, ESET security researcher Jean-Ian Boutin said the attacks have been carried out by members of the Lazarus Group -- codename given by security firms to North Korea's biggest hacking unit, part of the country's intelligence service.
Click to expand...

BEC SCAM ATTEMPTS
But Boutin said that once hackers gathered all the intelligence and proprietary data files they needed from a hacked company, the intrusion didn't stop there. Instead of erasing their footprints, the hackers moved on to attempting to scam the infected company's business partners.

"They followed up the conversation and urged the customer to pay the invoice, however, to a different bank account than previously agreed," the ESET team wrote in a report published today [PDF].
The attempt to defraud the victim's customers, also known as a business email compromise (BEC) scam, was thwarted, ESET said, as business partners usually noticed something off about the hackers' follow-up emails.
Click to expand...

guest · Jul 30, 2020

US defense and aerospace sectors targeted in new wave of North Korean attacks
Cyber-security firm McAfee publishes details about "Operation North Star."
July 30, 2020
https://www.zdnet.com/article/us-de...targeted-in-new-wave-of-north-korean-attacks/

While the world was in the midst of the COVID-19 pandemic, North Korean hackers were targeting the US defense and aerospace sectors with fake job offers in the hopes of infecting employees looking for better opportunities and gaining a foothold on their organizations' networks.
The attacks began in late March and lasted throughout May 2020, cyber-security firm McAfee said in a report published today.

Tracked under the codename of "Operation North Star," McAfee said these attacks have been linked to infrastructure and TTPs (Techniques, Tactics, and Procedures) previously associated with Hidden Cobra -- an umbrella term the US government uses to describe all North Korean state-sponsored hacking groups.
THE GOOD OL' FAKE JOB OFFER TRICK
As for the attacks themselves, McAfee said they were run-of-the-mill spear-phishing emails that enticed recipients to open boobytrapped documents containing a possible job offer.
Click to expand...

The entire infection chain, from contact to how the malware operates, is detailed in summary in the graphic below, and in full glorious technical details in the McAfee report.

Questions, however, remain about the efficacy of this campaign. With workforce movement at an all-time low during the coronavirus pandemic, it's unclear how successful North Korean hackers were by employing a "new job" theme to lure in victims.
Click to expand...

McAfee: Operation (노스 스타) North Star A Job Offer That’s Too Good to be True?

In this 2020 campaign McAfee ATR discovered a series of malicious documents containing job postings taken from leading defense contractors to be used as lures, in a very targeted fashion. These malicious documents were intended to be sent to victims in order to install a data gathering implant.
Click to expand...

guest · Aug 15, 2020

North Korean hackers are targeting Israel's defense sector, Israel Ministry of Defense claims
August 12, 2020
https://www.cyberscoop.com/north-korea-hackers-lazarus-group-israel-defense/

North Korean government-linked hackers have been targeting the Israeli defense sector with fake job offers, Israel’s Ministry of Defense said Wednesday.

The actors, which Israel says were part of Lazarus Group, a hacking outfit the U.S. government has linked to North Korea, sent their phony job offers through LinkedIn. The hackers created fake LinkedIn accounts impersonating CEOs and top officials at multinational companies to run their scam, according to the Ministry of Defense.
According to ClearSky, an Israeli cybersecurity firm which has been tracking the campaign, the hackers imitated the likes of Boeing, McDonnell Douglas, and BAE.

After making contact with targets, the hackers continued conversations with victims over WhatsApp, ClearSky said in a research report issued Thursday.
Click to expand...

The attackers were interested in compromising the employees’ computers, infiltrating their networks, and stealing sensitive security information, the Ministry of Defense said.
According to ClearSky, however, the North Korean hackers’ campaign has succeeded on a number of occasions, infecting “several dozens” of companies and organizations both in Israel and around the world.

North Korean government-linked hackers have continued to pose as job recruiters or send fake job offers even though it is not apparent if any of their previous efforts have been successful.
Click to expand...

Clearsky: Operation ‘Dream Job’ Widespread North Korean Espionage Campaign

During June-August of 2020, ClearSky’s analysis team had investigated an offensive campaign attributed with high probability to North Korea, which we call “Dream Job”. This campaign has been active since the beginning of the year and it succeeded, in our assessment, to infect several dozens of companies and organizations in Israel and globally. Its main targets include defense, governmental companies, and specific employees of those companies.
Click to expand...

guest · Nov 5, 2020

mood said: ↑

US defense and aerospace sectors targeted in new wave of North Korean attacks July 30, 2020

McAfee: Operation (노스 스타) North Star A Job Offer That’s Too Good to be True?
Click to expand...

North Korean Hackers Used 'Torisma' Spyware in Job Offers-based Attacks
November 5, 2020
https://thehackernews.com/2020/11/north-korean-hackers-used-torisma.html

A cyberespionage campaign aimed at aerospace and defense sectors in order to install data gathering implants on victims' machines for purposes of surveillance and data exfiltration may have been more sophisticated than previously thought.

Tracked under the codename of "Operation North Star" by McAfee researchers, initial findings into the campaign in July revealed the use of social media sites, spear-phishing, and weaponized documents with fake job offers to trick employees working in the defense sector to gain a foothold on their organizations' networks.
Click to expand...

Not only did the campaign use legitimate job recruitment content from popular US defense contractor websites to lure targeted victims into opening malicious spear-phishing email attachments, the attackers compromised and used genuine websites in the US and Italy — an auction house, a printing company, and an IT training firm — to host their command-and-control (C2) capabilities.

"Using these domains to conduct C2 operations likely allowed them to bypass some organizations' security measures because most organizations do not block trusted websites," McAfee researchers Christiaan Beek and Ryan Sherstibitoff said.
Click to expand...

What's more, the first-stage implant embedded in the Word documents would go on to evaluate the victim system data (date, IP Address, User-Agent, etc.) by cross-checking with a predetermined list of target IP addresses to install a second implant called Torisma, all the while minimizing the risk of detection and discovery.

"This campaign was interesting in that there was a particular list of targets of interest, and that list was verified before the decision was made to send a second implant, either 32 or 64 bits, for further and in-depth monitoring," the researchers said.
Click to expand...

McAfee: Operation North Star: Behind The Scenes

Log in or Sign up

Espionage Campaign Targeted Aerospace, Military Firms With Malware

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Espionage Campaign Targeted Aerospace, Military Firms With Malware

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches