European Defense Companies the Target of Cyber Espionage Over LinkedIn

By posing as recruiters on LinkedIn, a new tactic has emerged by which advanced persistent threat (APT) hackers have been able to commit cyber espionage. This was evidenced by the findings of a recent report, which found that cybercriminals—believed to be affiliated with the North Korean government—posed as recruiters working at the U.S. defense groups Collins Aerospace and General Dynamics in order to break into the networks of European defense companies.

According to Slovakia-based cybersecurity firm ESET, the cyber espionage attempts took place between September and December of last year, and were uncovered after a collaborative investigation with two of the affected defense companies in Europe.

The investigation shed light not only on a previously undocumented type of malware, but also on the evolving techniques used by APT groups in their attempts to carry out cyber espionage on defense companies.

Defense companies targeted over LinkedIn

In order to compromise their targets, the cyber attackers made use of social engineering tactics over LinkedIn against various European defense companies in a process that saw them hide behind the “ruse” of “attractive, but bogus”, job offers, the ESET researchers explained in a blog post announcing their findings.

Once they had piqued the interest of the employees at the defense companies, attackers were then able to deploy custom multistage malware, along with modified open-source tools, ESET noted.

“Besides malware, the adversaries made use of living off the land tactics, abusing legitimate tools and OS functions,” the researchers wrote. “Several techniques were used to avoid detection, including code signing, regular malware recompilation and impersonating legitimate software and companies.”

The malware was sent over LinkedIn’s chat application under the guise of being documents relating to a new occupational position. Introductory messages frequently began along the lines of, “Dear Sir, Collins Aerospace is a global aerospace and defense company. I saw your profile and then I like your enthusiasm. We welcomes elites like you [sic]”, according to screenshots obtained by ESET.

When a potential victim took the bait, the attackers either used LinkedIn directly, or a combination of email and OneDrive to send them malicious files. For the case of email and OneDrive, the attackers used fake email accounts corresponding with their fake LinkedIn personas, and included OneDrive links hosting the files, the researchers noted.

The fake LinkedIn accounts used to launch the attempted cyber espionage attacks no longer exist on the platform, ESET said.

All in all, according to the researchers, the cyber espionage attempts against European defense companies were notable for their “compelling, LinkedIn-based social engineering scheme, custom modular malware and cunning detection evasion tricks”. In addition, while the operation did indeed resemble a case of cyber espionage, the attackers apparently also had financial gain as a goal, as evidenced by the attempted BEC attack, ESET said.

Furthermore, while ESET was unable to reveal the identity of the attackers responsible for the cyber espionage attempts, it did tentatively point to the high-profile North Korean hacking group Lazarus.

Cyber espionage a persistent threat

The lure of financial gain and the promise of the sensitive national information in the hands of defense companies has led HR to become a prime target for cybercriminals over the past years. According to Ilia Kolochenko, the founder and chief executive at the web security company ImmuniWeb, such attacks are “particularly dangerous” because they “aptly leverage inherent human weaknesses” in order to steal valuable trade secrets and conduct economic cyber espionage.

“Often, you don’t even need any hacking but to stumble upon a talkative or disgruntled employee who will readily share a great wealth of confidential information either unwittingly or maliciously,” explained Kolochenko.

The ongoing COVID-19 pandemic has only heightened the situation further, Kolochenko said. “It suffices to breach and backdoor their machines to get virtually unlimited access to corporate trade secrets,” he explained. “Some threat actors knowingly exploit the COVID-19 mess to cover some inconsistencies or other red flags during an interviewing process, for example, to convincingly explain why they cannot meet in person or send a formal employment proposal.”

As a result of this, according to Kolochenko, the path toward detection and mitigation is relatively clear-cut for organizations. Employee training and security awareness should be made a vital part of the onboarding process, at defense companies in particular, and in organizations in general.

In addition, work-from-home infrastructure should be properly inventoried and monitored, with access to corporate data only being provided on the “as-needed” basis with a proactive monitoring of any anomalies. “Last but not least, it won’t hurt to hire an external law firm to review your confidentiality and intellectual property clauses in employment contracts,” Kolochenko added.

Photo and Link: https://www.cpomagazine.com/news/european-defense-companies-the-target-of-cyber-espionage-over-linkedin/