A North Korean hacking group is believed to be behind a new malware campaign that makes use of fake job offers on LinkedIn to lure its victims.
The group is posting fake job offers in the media, tech and defense industries under the guise of legitimate recruiters. They even impersonated the New York Times in one ad.
Threat intelligence firm Mandiant (opens in new tab) discovered the campaign has been ongoing since June 2022. It believes it is related to another malware campaign originating from North Korea, conducted by the infamous Lazarus group, known as “Operation Dream Job” which breaches systems belonging to crypto users.
Phishing for victims
Mandiant, for its part, believes the new campaign is from a separate group to Lazarus, and is unique in that the TouchMove, SideShow and TouchShift malware used in the attacks have never been seen before.
After a user responds to the LinkedIn job offer, the hackers then continue the process on WhatsApp, where they share a Word document containing dangerous macros, which install trojans from WordPress sites that the hackers have cracked and use as their control center.
This trojan, based on TightVNC and known as LidShift, in turn uploads a malicious Notepad++ plugin that downloads malware known as LidShot, that then deploys the final payload on the device: the PlankWalk backdoor.
After this, the hackers then use a malware dropper called TouchShift, concealed in a Windows binary file. This loads a plethora of additional malicious content, including TouchShot and TouchKey, a screenshot utility and keylogger respectively, as well as a loader call TouchMove.
It also loads another backdoor called SideShow, which allows for high-level control over the host’s system, such as the ability to edit the registry, change firewall settings and execute additional payloads.
The hackers also used the CloudBurst malware on companies that didn’t use a VPN, by abusing the endpoint management service Microsoft Intune.
In addition, the hackers also exploited a zero-day flaw in the ASUS driver “Driver7.sys”, which is used by another payload called LightShow to patch kernel routines in Endpoint protection software to prevent detection. This flaw has since been patched.
