GitHub Warns of Social Engineering Campaign Targeting Employees in the Technology Industry

A few weeks ago, GitHub posted on their blog a recent security alert that should have any organization in the tech industry worried.

GitHub identified a social engineering campaign that is targeting personal accounts of employees that work for technology firms. This campaign is using a combination of repository invites and malicious npm package dependencies to strike. The specific tech sectors are connected blockchain, cryptocurrency and online gambling industries, but there were also a few connected to the cybersecurity sector as well. 

GitHub believes that this campaign is associated with the cybercriminal group supporting North Korea efforts known as Jade Sleet by Microsoft Threat Intelligence and TraderTraitor by the U.S. Cybersecurity and Infrastructure Security Agency (CISA). Jade Sleet mostly targets users associated with cryptocurrency and other blockchain-related organizations, but they also target cybersecurity vendors used by those firms.

Per GitHub, "The attack chain operates as follows:

1. Jade Sleet impersonates a developer or recruiter by creating one or more fake persona accounts on GitHub and other social media providers. Thus far, we have identified fake personas that operated on LinkedIn, Slack, and Telegram. In some cases these are fake personas; in other cases, they use legitimate accounts that have been taken over by Jade Sleet. The actor may initiate contact on one platform and then attempt to move the conversation to another platform.
2. After establishing contact with a target, the threat actor invites the target to collaborate on a GitHub repository and convinces the target to clone and execute its contents. The GitHub repository may be public or private. The GitHub repository contains software that includes malicious npm dependencies. Some software themes used by the threat actor include media players and cryptocurrency trading tools.
3. The malicious npm packages act as first-stage malware that downloads and executes second-stage malware on the victim’s machine. Domains used for the second-stage download are listed below."

Unfortunately, social engineering campaigns will not go away anytime soon. Cybercriminals will do everything to target your employees - even outside of working hours. It's important to start training your employees now with new-school security awareness training, as your employees are the last-line of defense to protect your organization's network in and out of the office. 

GitHub has the full story.