Recruiters are being targeted via spear-phishing emails sent by cybercrooks impersonating job applicants, Proofpoint researchers are warning.
“The tone and content of the emails suggest to the recipient the actor is a legitimate candidate, and because the actor specifically targets people who are involved in recruiting and hiring, the emails do not immediately seem suspicious,” they noted.
The attack starts with an email, ends with malware
The threat actor – designated as TA4557 by Proofpoint – first reaches out to recruiters with a spear-phishing email with no malicious link or attachment, just an inquiry into whether a job position at a company is still open.
This first email is meant to prime the recruiter to implicitly trust the link provided in the follow-up email, which points to a fake resume website.
(Sometimes there is no link: the recipient is instructed to copy-paste the domain name of the sender’s email address to access the sender’s personal site.)
A follow-up email (Source: Proofpoint)
“The website uses filtering to determine whether to direct the user to the next stage of the attack chain,” the researchers explained.
“If the potential victim does not pass the filtering checks, they are directed to a page containing a resume in plain text. Alternatively, if they pass the filtering checks, they are directed to the candidate website.”
The latter uses a CAPTCHA that, when completed, triggers the download of a ZIP file containing a shortcut file (LNK).
If the victim executes the LNK file, a series of actions are performed in the background:
- A scriptlet is downloaded and executed (by abusing legitimate software functions)
- The scriptlet drops a DLL file in the %APPDATA%Microsoft folder and tries to execute it either via Windows Management Instrumentation (WMI) or the ActiveX Object Run method
- The DLL retrieves a RC4 key, which it uses to decipher the More_Eggs backdoor, and drops the backdoor and a MSXSL executable
- WMI is again used to create the MSXSL process, and the DLL deletes itself
The backdoor, which can be used to profile the system, drop additional malicious payloads and establish persistence, is finally safely ensconced on the target machine.
Evading automated detection
The researchers say that they have seen an increase in threat actors using benign messages to build trust and engage with a target before sending the malicious content.
“Proofpoint has been tracking TA4557 since 2018 as a skilled, financially motivated threat actor known to distribute the More_Eggs backdoor,” the researchers said.
“In recently observed campaigns, TA4557 used both the new method of emailing recruiters directly as well as the older technique of applying to jobs posted on public job boards to commence the attack chain.”
The threat actor is regularly changing their sender emails, fake resume domains, and infrastructure to prevent their emails to be flagged by email filters. For the same reason the group starts their attack with an email that automated security tools are unlikely to “see” as suspicious or malicious.