Hackers Target HR Departments with Fake Resumes to Spread More_eggs Malware

The financially motivated threat group Venom Spider, also tracked as TA4557, has shifted its focus to corporate Human Resources (HR) departments with a highly targeted spear-phishing operation.

According to research by Arctic Wolf Labs, the group is leveraging legitimate job platforms and messaging services to send fraudulent job applications laced with malicious resumes.

These deceptive documents are designed to deploy a potent backdoor known as More_eggs, capable of credential theft, harvesting sensitive customer payment data, and stealing intellectual property or trade secrets.

– Advertisement –

This tactical pivot to HR targeting broadens Venom Spider’s potential victim pool, as every industry relies on hiring new talent, making this campaign a significant threat to organizations worldwide.

Technical Breakdown of the More_eggs Attack Chain

The attack begins with a spear-phishing email directed at HR managers and recruiters, containing a link to a malicious website posing as a resume download page.

Once clicked, the link leads to an actor-controlled site where victims must pass a CAPTCHA test-a clever mechanism to evade automated scanners.

Upon completion, a ZIP file is downloaded, containing a decoy image and a malicious Windows shortcut (.LNK) file.

This .LNK file, generated uniquely for each download via server-side polymorphism, embeds an obfuscated batch script that manipulates legitimate Windows utilities like ie4uinit.exe to execute commands covertly.

This living-off-the-land (LOTL) technique helps bypass detection while launching distracting applications like WordPad to mislead users into believing they are opening a genuine resume.

Subsequent stages involve downloading obfuscated JavaScript payloads from domains such as doefstf[.]ryanberardi[.]com, which then deploy the More_eggs_Dropper library-a dynamic-link library (DLL) registered via regsvr32.

This library generates polymorphic JavaScript code with time-delayed execution to thwart sandbox analysis, creating additional malicious files in the victim’s AppData directory.

The final More_eggs backdoor payload employs advanced encryption with device-specific keys (combining computer name and processor identifier) and brute-forced decryption components, ensuring that payloads are uniquely tailored to each infected system.

Once active, the backdoor establishes persistent command-and-control (C2) communication with servers like tool[.]municipiodechepo[.]org, enabling threat actors to execute remote commands, download additional malware, and exfiltrate sensitive data.

This campaign showcases Venom Spider’s refined tactics, including enhanced code obfuscation, encrypted payloads, and decentralized cloud-hosted infrastructure on platforms like Amazon and GoDaddy, making tracking and mitigation challenging.

Historically targeting e-commerce sectors in the U.S., such as retail and pharmacy, the group’s focus on HR exploits a universal vulnerability-recruiters’ routine handling of external attachments.

According to the Report, Arctic Wolf recommends that organizations bolster defenses through employee training on phishing red flags, deploy Secure Email Gateways, and implement Endpoint Detection and Response (EDR) solutions.

Additionally, inspecting suspicious file properties before opening and blocking known C2 domains are critical steps to counter this threat.

As Venom Spider continues to evolve its More_eggs malware, vigilance and proactive cybersecurity measures remain essential to safeguard against these insidious social engineering attacks.

Indicators of Compromise (IOCs)

Find this News Interesting! Follow us on Google News, LinkedIn, & X to Get Instant Updates!