Fake job listings help suspected Iranian hackers aim at targets in Lebanon

They're using fake job documents to target victims.

Suspected Iranian hackers have zeroed-in on a target in Lebanon, according to Check Point research published Thursday.

Researchers caught attackers sending an unidentified Lebanese target documents that purported to contain details about job opportunities. If accessed in certain ways, those documents would deploy malware against victims. One such document imitated Ntiva IT, a consulting firm based in Virginia, Check Point said.

In order to be infected, targets would have needed to enable macros on the documents, triggering a process that launches malware every five minutes.

The hackers, which Check Point suspects belong to a hacking group known as APT34 or OilRig, have been using a new backdoor to access their targets, according to the researchers. APT34, which researchers say has been operating since 2014, is believed to frequently rely on decoy job opportunities to trap targets in their campaigns.

The group used LinkedIn in 2019 to go after espionage targets with fake job opportunities, according to FireEye research, for instance. In one other campaign, known as DNSpionage, hackers went after Lebanese and United Arab Emirates targets with websites containing fake job postings, according to Cisco Talos research. Talos researchers found a potential link between the DNSpionage hacking and the suspected Iranian hackers.

The hackers, which FireEye suspects has backing from the Iranian government, frequently aim to infiltrate governments in the Middle East, and organizations in the financial, government, energy and telecommunications sectors. Check Point did not providing identifying information about the apparent Lebanese targets.

Check Point attributes the latest campaign to APT34 due to similarities between this operation and previous APT34 schemes — including the macros, the backdoor, the approach to targets and other technical similarities, researchers note in blog on their findings.

In previous campaigns the attackers used imitation websites to conduct command-and-control communications, then gather data.

Check Point suggests that some of the differences in the campaigns are likely rooted in the fact that the hacking group’s tools were leaked in 2019, forcing APT34 to revamp its operations.

“Iran-backed APT34 shows no sign of slowing down, further pushing its political agenda in the middle-east, with an ongoing focus on Lebanon – using offensive cyber operations,” researchers noted.

The U.S. National Security Agency and the U.K.’s National Cyber Security Centre have been tracking the suspected Iranian cyber-espionage group’s activities for years. A two-year long investigation, which the NSA and NCSC jointly unveiled in 2019, showed Turla, a hacking group with links to Russian intelligence, was piggybacking on APT34’s hacking infrastructure.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure

• Election official says Tina Peters would be consultant, won’t have access to election systems