- Proofpoint says more state-sponsored groups seen using clickfix attacking technique
- Russians, North Koreans and Iranians involved all
- State sponsored actors are mostly engaged in cyber-spyage
The Clickfix attacking technique has become so popular that even state-sponsored threat actors use it, research from proofpoint claims, after observing at least three groups utilizing the method in the last quarter of 2024.
In an in -depth report, Proofpoint said it saw Kimsuky, Muddywater, UNK_Remoterogue and APT28, all using clickfix in their attack chains.
Kimsuky is a well -known North Korean threat actor, Muddywater is Iranian, while UNK_Remoterogue and APT28 are reportedly Russian. Apart from North Korea’s Lazarus group, state-sponsored threat actors are mostly engaged in cyber espionage, stealing sensitive information from diplomats, critical infrastructure organizations, think tanks and similar organizations from opponent’s states.
No revolution
“Incorporation of Clickfix does not revolutionize the campaigns performed by TA427, TA450, UNK_Remoterogue and TA422, but instead replace the installation and execution stages in existing infection chains,” explained Proofpoint.
Clickfix has made headlines for months now. It is a social engineering tactic that looks like old “you have a virus” opups that used to plague internet sites two decades ago.
Originally, popup would invite visitors to download and run an antivirus program that was actually just malware.
As the industry treated this attack by beating the infrastructure, Crooks turned to leave a phone number for alleged IT support.
Victims calling this number would be tricked into installing remote desktop programs, giving Crooks the opportunity to download and run malware on their devices.
The Clickfix attack takes this method and gives it a unique spin. It still starts with a popup, but sometimes the victims are also asked to “implement a captcha”, “verify their identity” or similar. The process does not require them to click on a download button, but instead ask them to copy and insert a command into their Run program.
Although it sounds long -term, it has also been quite successful, proven by the adoption of nation states.
Via Hacker the news
