On Monday, Google revealed a sophisticated cyber campaign orchestrated by a North Korean state-sponsored group aimed at security researchers involved in vulnerability research and development. This latest information highlights the increasing threat posed by adversaries adept at manipulating credible sources in the cybersecurity community.
The Threat Analysis Group (TAG) at Google reported that the attackers established a phony research blog and created multiple profiles across various social media platforms, including Twitter, LinkedIn, Telegram, Discord, and Keybase. This strategy appears to be designed to foster communication and build trust with security researchers, ultimately with the intention of harvesting exploits that could be utilized against vulnerable targets.
The motivation behind this operation seems to be the acquisition of exploits related to vulnerabilities that have yet to be disclosed publicly. By obtaining this information, the attackers could potentially enhance their arsenal for launching further cyber assaults on unprotected systems.
According to TAG researcher Adam Weidemann, these fake profiles have successfully disseminated write-ups and analyses of publicly disclosed vulnerabilities, including misleading guest posts purportedly authored by legitimate security researchers. This tactic serves to bolster the attackers’ credibility within the research community.
The malicious actors have employed up to ten fabricated Twitter accounts and five counterfeit LinkedIn profiles to engage with researchers, showcasing videos of exploits while sharing links to their bogus research blog. In one notable instance, a Twitter persona posted a YouTube video that falsely claimed to demonstrate an exploit for a recently patched Windows Defender vulnerability, later confirmed to be a ruse.
The hackers also developed an innovative social engineering approach wherein they invited security researchers to collaborate on vulnerability projects. Following these invitations, the targeted individuals received a Visual Studio Project that not only contained exploit source code but also introduced custom malware capable of establishing a connection to a remote command-and-control (C2) server, thereby allowing intruders to execute arbitrary commands on compromised systems.
Research by Kaspersky’s Costin Raiu indicated that the malware was akin to Manuscrypt, a known backdoor associated with the Lazarus Group. TAG further uncovered multiple instances where researchers inadvertently infected their systems after visiting the deceptive research blog. This led to the installation of a malicious service, which initiated communication with a C2 server via an in-memory backdoor.
In light of these developments, TAG advises researchers to isolate their work environments. Utilizing separate physical or virtual machines for diverse tasks—like web browsing and data-sharing interactions—can mitigate the risk posed by such targeted campaigns.
In a related update, Microsoft has corroborated Google’s findings, attributing the ongoing attacks to a threat actor referred to as ZINC, also recognized as the Lazarus Group. Their analysis suggests that the campaign developed roots in mid-2020, with the adversary making concerted efforts to establish itself in the security research community through credible social media engagement.
Microsoft revealed that some researchers were infected without prior interaction with the ZINC profiles, merely by visiting the malicious blog. This scenario underscores the sophisticated operations conducted by the group, which appears to have used a browser vulnerability exploit to facilitate the compromises.
From the perspective of the MITRE ATT&CK framework, relevant tactics exhibited in this cyber campaign include initial access via social engineering and exploitation of public-facing applications, persistence through the deployment of backdoors, and privilege escalation through malicious installations. Such a comprehensive understanding of the tactics not only highlights the complexity of contemporary cyber threats but also emphasizes the need for heightened vigilance among cybersecurity professionals.
