A state-sponsored threat actor is sending spear phishing emails to North Korean defectors and also to journalists who cover matters related to North Korea, according to researchers at Kaspersky. The threat actor first messages the target via a hacked Facebook account belonging to one of the target’s acquaintances.
“Before spear-phishing a potential victim and sending a malicious document, the actor contacted an acquaintance of the victim using the victim’s stolen Facebook account,” the researchers write. “The actor already knew that the potential target ran a business related to North Korea and asked about its current status. After a conversation on social media, the actor sent a spear-phishing email to the potential victim using a stolen email account. The actor leveraged their attacks using stolen login credentials, such as Facebook and personal email accounts, and thereby showed a high level of sophistication.”
Next, the actor sends the victim an email with a malware-laden Microsoft Word document.
“After a Facebook conversation, the potential target received a spear-phishing email from the actor,” Kaspersky says. “It contains a password-protected RAR archive with the password shown in the email body. The RAR file contains a malicious Word document.”
The researchers also note that the threat actor also takes steps to bypass SMS-based two-factor authentication.
“To sum up, the actor targeted victims with a probable spear-phishing attack for Windows systems and smishing for Android systems,” the researchers write. “The actor leverages Windows executable versions and PowerShell versions to control Windows systems. We may presume that if a victim’s host and mobile are infected at the same time, the malware operator is able to overcome two-factor authentication by stealing SMS messages from the mobile phone. After a backdoor operation with a fully featured backdoor, the operator is able to steal any information they are interested in. Using the stolen information, the actor further leverages their attacks.”
New-school security awareness training can enable your employees to thwart targeted social engineering attacks.
Kaspersky has the story.
Here's how it works:
