Watch out - that amazing job offer could actually just be a crypto-stealing scam, Microsoft warns

Date:
Mon, 13 Nov 2023 18:58:08 +0000

Description:
Hackers have started impersonating skills assessment platforms to trick you into giving away your crypto.

FULL STORY ======================================================================

The BlueNoroff cybercrime campaign appears to be going from strenght to strenght after Microsoft spotted yet another criminal campaign it attributed to the North Korean hackers.

Redmonds security pros recently found BlueNoroff (a part of the Lazarus Group advanced persistent threat, which it calls Sapphire Sleet) impersonating skills assessment portals and using them to steal peoples sensitive data or have them download malware .

"Sapphire Sleet typically finds targets on platforms like LinkedIn and uses lures related to skills assessment," the Microsoft Threat Intelligence team said on X. "The threat actor then moves successful communications with
targets to other platforms."

Reader Offer: $50 Amazon gift card with demo
Perimeter 81's Malware Protection intercepts threats at the delivery stage
to prevent known malware, polymorphic attacks, zero-day exploits, and more. Let your people use the web freely without risking data and network security.

Preferred partner ( What does this mean? ) Distributing malware

BlueNoroff, but also Lazarus as a whole, is a threat actor thats been seen using fake job ads and targeting professionals in the cryptocurrency industry for years now. With that in mind, the latest campaign that includes skills assessment portals is a shift in the persistent actors tactics, Microsoft said.

Late last week, security researchers from Jamf warned of a new macOS malware, called ObjCShellz, which was developed and distributed by BlueNoroff. It greatly overlaps with another macOS malware known as RustBucket.

Microsoft said BlueNoroff usually distributed malware by sending malicious attachments or embedded links to pages hosted on GitHub. However, Microsofts quick reactions to remove these threats forced Sapphire Sleet to create a new network of websites used to distribute the malware, the researchers claim.

"Several malicious domains and subdomains host these websites, which entice recruiters to register for an account," the company added. "The websites are password-protected to impede analysis."

Lazarus Group is suspected to be under the direct command of the North Korean government. Its goals are not always the same, but are usually linked to stealing cryptocurrencies from targets in the West. The money, some sources are saying, are being used to sustain the government and build the nuclear weapons program More from TechRadar Pro North Korean hackers are targeting Apple users with new macOS malware Here's a list of the best firewalls today These are the best identity theft protection tools right now



======================================================================
Link to news story: https://www.techradar.com/pro/security/watch-out-that-amazing-job-offer-could- actually-just-be-a-crypto-stealing-scam-microsoft-warns


--- Mystic BBS v1.12 A47 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)