For North Korea, phishing with fake job

This time, the spies were trying to get access to European defense firms, McAfee says.

Give someone an undetected software exploit and they’ll have access to a system for a day, the security researcher The Grugq once said, but teach them to phish and they’ll have “access for life.”

North Korean hackers have been following that bit of social-engineering wisdom to a T. In recent years, they have consistently posed as job recruiters to try to phish their way into the networks of aerospace and defense firms on multiple continents. The latest activity— a months-long spying campaign against aerospace and defense firms — was revealed this week by researchers from McAfee. Malware from the campaign has been detected in the U.S. and Europe.

The suspected North Korean hackers appear to be spearphishing their targets using Microsoft Word documents with job descriptions involving active defense contracts, according to McAfee. Their goal is to use that foothold to plant additional code to gather data on their targets, the researchers said. It’s unclear how successful the hackers have been in gathering data or what they’ve done with it. North Korea has one of the biggest active-duty militaries in the world, and Pyongyang has every interest in surveilling the capabilities of its adversaries.

“It’s ongoing—we discovered a new [malicious] document last week,” Christiaan Beek, senior principal engineer and lead scientist at McAfee, said of the hacking campaign.

Public exposure hasn’t made the North Koreans any less willing to use the job-recruitment ploy. A 2018 Department of Justice criminal complaint alleged that North Korean hackers had posed as a job recruiter to try to breach U.S. defense firm Lockheed Martin, prosecutors said. The trick didn’t work that time, but its success elsewhere means the North Koreans have every reason to keep using it.

The hackers have made a point of copying job descriptions from the defense contractors’ websites, focusing on sensitive work in military surveillance and security programs.

“Human beings are curious and flattered when we receive an interesting job offer from an interesting company,” Beek told CyberScoop. “If you were to receive a job offer for…a reporting position at an interesting company, wouldn’t you open it, too [after checking the email-headers of the source]?”

The use of LinkedIn can make it easier to reach targets. In late 2019, a group of spies posing as headhunters used LinkedIn to hack employees at two European aerospace and defense firms. ESET, the anti-virus company that investigated, couldn’t confirm that North Korea was behind the hacking. But they didn’t name any other suspects, either.

On Thursday, the European Union announced sanctions against a North Korean firm for its alleged role in the 2017 WannaCry ransomware attack and the 2016 theft of $81 million from the Bank of Bangladesh.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure