cyber.hendryadrian.com
Threat Research · bitdefender.com

Lazarus-Linked Recruiting Scam Uses Cross-Platform Malware to Steal Data

· Original article ↗

Summary

Bitdefender details a suspected Lazarus campaign using fake LinkedIn job offers and malicious code repositories to deploy cross-platform malware that steals credentials, files, and cryptocurrency data.

Key points

  • The campaign uses fake LinkedIn recruiting messages and asks targets to review a project by running code from a repository.
  • Obfuscated JavaScript loads an infostealer targeting Windows, macOS, and Linux, including browser data and cryptocurrency-wallet-related files.
  • Follow-on Python modules collect system information, files, browser data, keystrokes, and clipboard contents, and maintain communication with attacker-controlled servers.
  • A .NET payload can add malicious files to Microsoft Defender exclusions, use Tor for command-and-control, and deploy backdoor, file-stealing, keylogging, and crypto-mining modules.
  • Bitdefender assesses the activity as linked to North Korean actors, specifically Lazarus; the article says the campaign could expose enterprise credentials and sensitive information.
  • Bitdefender advises verifying job offers and avoiding unverified code, or testing it in a virtual machine or sandbox.

Article Details

Attack Vectors
  • Fake LinkedIn recruiting messages lure targets into sharing personal information or GitHub repository links.
  • Targets are directed to run a project demo containing obfuscated code that loads malicious code from an external endpoint.
  • A JavaScript stealer harvests browser login and cryptocurrency-extension data, then downloads and executes a Python script that enables additional payloads.
  • Additional Python and .NET payloads collect browser data, files, credentials, keystrokes, and system information, and communicate with attacker-controlled servers.
Defensive Notes
  • Avoid running unverified code, especially on enterprise devices; use virtual machines, sandboxes, or online testing platforms when testing code.
  • Verify job offers through official corporate websites and confirm email domains.
  • Treat vague job descriptions, suspicious repositories with random names or little documentation, and poor communication as warning signs.

Indicators of compromise

TypeIndicatorContext
MD5617205f5a241c2712d4d0a3b06ce3afdHash identified in the article as belonging to a payload executable.

MITRE ATT&CK

T1005 · Data from Local SystemThe malware searched for and collected files, including documents, private keys, and cryptocurrency mnemonics.T1041 · Exfiltration Over C2 ChannelThe malware exfiltrated stolen browser data, files, and other information to attacker-controlled servers.T1056.001 · KeyloggingA keylogger used win32 APIs to capture and exfiltrate keystrokes.T1059.006 · PythonPython scripts recursively decoded themselves and carried out further malicious activities.T1059.007 · JavaScriptA JavaScript stealer dynamically loaded malicious code and downloaded further payloads.T1082 · System Information DiscoveryA payload collected host, operating system, processor, GPU, and RAM information.T1115 · Clipboard DataA Python module monitored system-wide clipboard changes for cryptocurrency-related data.T1204.002 · Malicious FileTargets were asked to execute a project demo containing malicious code.T1555.003 · Credentials from Web BrowsersThe malware extracted login data and other sensitive information from browsers.T1562.001 · Disable or Modify ToolsA dependency added malicious binaries to the Microsoft Defender exception list.T1566.003 · Spearphishing via ServiceAttackers used LinkedIn recruiting messages to lure targets into the operation.

People

Alina BÎZGĂNamed author of the article.Andrei ANTON-AANEINamed author of the article.Ionut Alexandru BALTARIUNamed author of the article.

Threat Actors

APT 38The article identifies APT 38 as a group linked to the Lazarus Group.Lazarus GroupThe article attributes the recruiting scam and malware campaign to Lazarus Group and describes it as North Korea-linked.

Products

LinkedInLazarus Group Targets Organizations with Sophisticated LinkedIn Recruiting ScamMicrosoft Defenderthe main payload. One of the dependencies adds malicious binaries to the exception list of Microsoft Defender, while also downloading and starting a Tor Proxy Server to communicate with the Command & Control

Tools

Tsunami InjectorRuns the Tsunami Injector python script that connects to multiple Pastebins to reach the URL for the payload (.exe 617205f5a241c2712d4d0a3b06ce3afd) 

Countries

North KoreaBitdefender Labs warns of an active campaign by the North Korea-linked Lazarus Group, targeting organizations by capturing credentials and delivering malware through fake LinkedIn job offers.

Industries

AviationTheir objectives go beyond personal data theft. By compromising people working in sectors such as aviation, defense, and nuclear industries, they aim to exfiltrate classified information, proprietary technologies, andDefenseobjectives go beyond personal data theft. By compromising people working in sectors such as aviation, defense, and nuclear industries, they aim to exfiltrate classified information, proprietary technologies, andnucleargo beyond personal data theft. By compromising people working in sectors such as aviation, defense, and nuclear industries, they aim to exfiltrate classified information, proprietary technologies, and corporate

Related Articles