Domaintools discover hackers that create fake job -seeking personas They are targeted at recruiters and HR leaders with the more eggs back door The back door can steal credentials and perform commands
Hackers are now pretending to be job seekers who target recruiters and organizations with dangerous backdoor malware, experts have warned.
Cybersecurity scientists Domaintools recently discovered a threat actor known as Fin6 using this method in nature, noting that the hackers would first create false personas on LinkedIn and create false resume places to go together.
The website’s domains are purchased anonymously via Godaddy and hosted at Amazon Web Services (AWS) to avoid being marked or quickly taken down.
More eggs
The hackers then reached out to recruiters, HR managers and business owners on LinkedIn and build a report before moving the conversation to E email. Then they share the resume website that filter visitors based on their operating system and other parameters. For example, people who come through VPN or cloud connections are served as well as those running macOS or Linux, benign content.
Those considered a good fit are first served a fake captcha, after which they are offered a .zip archive for download. This archive, in what recruits believe is CV, is actually falling a disguised Windows Beautiful File (LNK) that runs a script that downloads “more eggs” back door.
Several eggs are a modular back door that can perform commands, steal login credentials, provide additional payloads and perform Powershell in a simple but effective attack that depends on social technique and advanced evasion.
AWS has since come forward to thank the security community for the conclusions and emphasize that campaigns like this violate its Terms of Service and are often removed from the platform.
“AWS has clear terms that require our customers to use our services in accordance with applicable laws,” said a AWS spokesman.
“When we receive reports of potential violations of our terms, we are acting quickly to review and take steps to disable prohibited content. We value collaboration with the Security Research Community and encourage researchers to report suspected abuse to AWS Trust & Safety through our dedicated abuse reporting process.”
Via Bleeping computer
You also like
