Skip to main content

North Korean hackers create fake job offers to steal important data

Lazarus, a state-sponsored hacker group based in North Korea, is now using open-source software and creating fake jobs in order to spread malware, says Microsoft.

The well-known group of hackers is targeting many key industry sectors, such as technology, media entertainment, and defense, and it’s using many different kinds of software to carry out these attacks.

An image describing how the hacker group ZINC operates.

The next time you get a message on LinkedIn, you should be careful. Microsoft warns that the North Korea-based threat group has been actively using open-source software infected with trojans to attack industry professionals. Microsoft has determined that these social engineering attacks started in late April and continued until at least mid-September.

Lazarus, also referred to as ZINC, Labyrinth Chollima, and Black Artemis, is a state-sponsored military hacking group from North Korea. It’s said that it has been active since at least 2009, and since then it’s been responsible for a variety of large attacks, including phishing, ransomware campaigns, and more.

The group has been creating fake LinkedIn recruiter profiles and approaching suitable candidates with job offers at legitimate, existing companies. “Targets received outreach tailored to their profession or background and were encouraged to apply for an open position at one of several legitimate companies,” said Microsoft.

Once the victims were convinced to move the conversation over from LinkedIn to WhatsApp, which offers encrypted communication, the hackers moved on to the next step. During the WhatsApp conversation, the targets received infected software that allowed Lazarus to deploy malware on their systems.

The end goal for the hackers was to be able to steal sensitive information or obtain access to valuable networks. Aside from the malware — which was found in programs such as PuTTY, KiTTY, TightVNC, muPDF/Subliminal Recording, and Sumatra PDF Reader — the attacks were well-engineered on the social side of things, too, with LinkedIn profiles and companies picked to match the victim’s profession.

A depiction of a hacker breaking into a system via the use of code.
Getty Images

As noted by Bleeping Computer, ZINC has also carried out similar attacks by using fake social media personas to distribute malware. Earlier, it was chiefly targeting security researchers; this time around, the attacks have a broader range.

These attacks seem like a follow-up to Operation Dream Job. The campaign, active since 2020, focused on targets from the defense and aerospace sectors in the U.S. and lured them in with interesting job offers, all with the goal of conducting cyber-espionage. Lazarus has also been spotted targeting cryptocurrency workers and crypto exchanges in the past.

How to protect yourself from these attacks? Try to keep your LinkedIn conversations on the platform, if at all possible. Don’t accept files from people you don’t know and make sure to use good antivirus software. Lastly, don’t be afraid to reach out to the company and verify that the person trying to send you files actually works there.

Monica J. White
Monica is a UK-based freelance writer and self-proclaimed geek. A firm believer in the "PC building is just like expensive…
Beware: Hackers are using a clever Microsoft Edge malvertising scam
The Microsoft Edge browser is open on a Surface Book 2 in tablet mode.

If you're still using Microsoft Edge, you need to beware -- a new malvertising campaign has just been discovered, and if you fall victim to it, your PC might be at risk.

According to Malwarebytes, the attackers are abusing Microsoft Edge's News Feed feature to target their victims. Here's what we know about this clever new scam.

Read more
How to clean a mouse pad — the right way
The Glorious Model O 2 Pro mouse sitting on a desk.

Even the latest and most "exciting" mouse mats can get dirty after long-term use. So it's a good idea to clean your mouse pad now and again — it not only looks better but it's more hygienic, too.

Here's how to clean your mouse pad to get it back to near-new condition.

Read more
Intel responds to reported laptop CPU instability problems
msi gt77 titan 2023 review 19

Update: Intel has provided Digital Trends with the following statement about CPU instability affecting mobile processors:

"Intel is aware of a small number of instability reports on Intel Core 13th/14th Gen mobile processors. Based on our in-depth analysis of the reported Intel Core 13th/14th Gen desktop processor instability issues, Intel has determined that mobile products are not exposed to the same issue. The symptoms being reported on 13th/14th Gen mobile systems – including system hangs and crashes – are common symptoms stemming from a broad range of potential software and hardware issues. As always, if users are experiencing issues with their Intel-powered laptops we encourage them to reach out to the system manufacturer for further assistance."

Read more