Nation-State Threat Actors Rely on Social Engineering First



Screensaver Spear Phishing CampaignA new report from ESET has found that most nation-state threat actors rely on spear phishing as a primary initial access technique.

In the second and third quarters of 2024, state-sponsored APTs from China, Russia, Iran, and North Korea used social engineering attacks to compromise their targets.

Iranian threat actors continued conducting cyber espionage against countries across the Middle East, Europe, and the US. They also expanded their targeting to hit financial companies in Africa.

“We observed indications that Iran-aligned groups might be leveraging their cyber capabilities to support diplomatic espionage and, potentially, kinetic operations,” ESET says.

“These groups compromised several financial services firms in Africa – a continent geopolitically important to Iran; conducted cyber espionage against Iraq and Azerbaijan, neighboring countries with which Iran has complex relationships; and increased their interest in the transportation sector in Israel. Despite this seemingly narrow geographical targeting, Iran-aligned groups maintained a global focus, also pursuing diplomatic envoys in France and educational organizations in the United States.”

The Russian threat actor Sednit (also known as “APT28” or “Fancy Bear”) launched phishing attacks designed to compromise Roundcube servers in a variety of sectors.

“We discovered new Sednit spear phishing waves, which are part of the already known Operation RoundPress campaign directed against Roundcube webmail servers,” the researchers write.

“In the past several months, we observed such spear phishing waves against governmental, academic, and defense-related entities in Cameroon, Cyprus, Ecuador, Indonesia, Romania, and Ukraine. Sednit used a wide range of lures, from legitimate news articles to a commercial brochure for thermal optics.”

The researchers note that North Korean threat actors often establish trust with their victims using phony employment offers before tricking them into installing malware.

“Another distinctive feature of many attacks that we attribute to North Korea-aligned groups is the gradual building up of the relationship with the victim,” ESET says. “Both Lazarus and Kimsuky used fake job offers to approach the targeted individuals. Only after the victim responds and a relationship is established, is a malicious package sent to the victim.”

KnowBe4 empowers your workforce to make smarter security decisions every day. Over 70,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.

ESET has the story.


Free BreachSim Tool

How easy is it for bad actors to penetrate your system and exfiltrate your data? Pinpoint vulnerabilities, take action and build stronger cyber defenses with KnowBe4’s Breach Simulator “BreachSim.” Based on techniques outlined in the MITRE Att&CK framework, BreachSim launches 12+ simulated scenarios to uncover the stark reality of what happens when employees unknowingly fall for an attack.

BreachSim LogoHow BreachSim works:

  • 100% harmless simulation of real breach and data exfiltration attacks
  • Provides secure .txt, .doc, and .bmp test files for the simulation
  • Tests 12+ realistic data exfiltration scenarios following the MITRE Att&CK framework
  • Just download the installer, upload the secure test files, and run

Results in a few minutes!

Try Now

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

https://www.knowbe4.com/free-tools/breach-simulator



Subscribe to Our Blog


Comprehensive Anti-Phishing Guide




Get the latest about social engineering

Subscribe to CyberheistNews