The landscape of cybercrime is constantly evolving, with threat actors employing new tactics to infiltrate systems and compromise sensitive data. In recent years, a growing trend has emerged, where threat actors target recruiters by masquerading as job applicants. This article delves into the intricacies of this attack vector, highlighting the attribution to the notorious FIN6 cybercrime group and providing a comprehensive overview of their attack method, email analysis, and other pertinent information.
Recruitment as a Target for Threat Actors
Recruiters play a crucial role in connecting individuals with job opportunities, making them an appealing target for threat actors seeking to exploit their trusted position. By impersonating job seekers, threat actors can gain access to recruitment systems and potentially compromise an organization’s sensitive information.
Attribution to the FIN6 cybercrime group
The FIN6 cybercrime group has gained notoriety for its involvement in various high-profile attacks, primarily targeting the retail and hospitality sectors. Known for their advanced techniques and sophisticated infrastructure, this group has recently been attributed to the attacks on recruiters disguised as job applicants.
Methods Used by Threat Actors
One of the primary methods employed by threat actors is sending seemingly legitimate job applications containing malicious URLs or attachments. These attachments and URLs serve as the initial access vector, allowing threat actors to exploit vulnerabilities and gain control over targeted systems.
Another method utilized by threat actors is directly emailing recruiters while masquerading as job applicants. These emails often contain malicious attachments or embedded URLs, enticing recruiters to click on them and unwittingly initiate the attack.
Execution of the Attack
When victims visit the domain or URL specified by the threat actor, a filtering check is performed as a vetting process. This filtering check determines whether the visitor should be redirected to the malicious website.
Regardless of the initial access method, the threat actors lure victims into downloading an archive file that contains an LNK shortcut file. In doing so, they exploit the victim’s curiosity surrounding potential job opportunities and entice them to unknowingly initiate the attack.
Once the LNK file is opened, it leverages the functionalities of the ie4uinit.exe file and ie4uinit.inf file. These files are exploited to silently download and execute a malicious DLL (Dynamic Link Library) on the victim’s system.
The malicious DLL, upon execution, retrieves the RC4 key required for decrypting the More_Eggs backdoor. This backdoor serves as a critical component for the threat actors to gain persistent access to the victims’ systems.
Once the More_Eggs backdoor is downloaded and executed, the threat actors can establish complete control over the victim’s systems. This enables them to carry out a range of malicious activities, ranging from data exfiltration to lateral movement within the compromised network.
By successfully deploying the More_Eggs backdoor, the threat actors gain unfettered access to the victims’ systems. This access allows them to harvest sensitive data, install additional malware, or even pivot to other systems within the network.
Publication of Detailed Report
In an effort to raise awareness and aid in the identification of ongoing attacks, a comprehensive report has been published. This report provides detailed insights into the attack vector and techniques, shedding light on the infrastructure, attack patterns, and indicators of compromise associated with the FIN6 cybercrime group.
The targeting of recruiters disguised as job applicants represents a worrying trend in cybercriminal activity. It highlights the need for increased vigilance among recruitment professionals and organizations alike. By understanding the techniques employed by threat actors, implementing robust security measures, and regularly updating defenses, we can mitigate the risk posed by these sophisticated attacks. Staying informed, remaining cautious, and fostering a culture of cyber resilience are crucial steps in safeguarding against such threats.