As a result, a ZIP archive is delivered to the target machine, which, among other things, contains a malicious version of the TightVNC remote desktop application that Mandiant monitors under the name LIDSHIFT. When the document is open and macros are enabled, the target machine downloads and executes the malicious payload from the hackers’ servers (mostly hacked WordPress sites).

Plankwalk and other malware in the group mainly use macros in Microsoft Word. Such accounts carefully imitate the identities of real people in order to deceive the victims and increase the chances of the attack being successful.Īfter contacting the victim and making her an “interesting job offer”, the attackers try to transfer the conversation to WhatsApp, and then use either the messenger itself or email to deliver the backdoor, which Mandiant called Plankwalk, as well as other malware families. Researchers say that UNC2970 recently changed tactics and now switched from using phishing emails to using fake LinkedIn accounts allegedly owned by HR. For these attacks, UNC2970 used spear-phishing emails disguised as job offers in an attempt to coerce their targets into installing the malware. Shortly thereafter, there was a spate of attacks on American and European media by the UNC2970 group, which Mandiant links to North Korea. Then the hackers tried to infect the target with three new malware families ( Touchmove, Sideshow and Touchshift). Mandiant says it first discovered the North Korean hacking campaign in June 2022 while tracking a phishing campaign targeting a US technology client. The media also wrote that FBI Links North Korean Lazarus Hackers to Harmony Hack and $100 Million Theft. Let me remind you that we also wrote that Nearly 50% of Cybersecurity Leaders Will Change Jobs by 2025, and also that Microsoft accused Russia and North Korea of attacks on pharmaceutical companies. Attackers try to infect researchers with malware in the hope of infiltrating the networks of companies that the targets work for. Mandiant experts noticed that North Korean hackers have focused their attention and attacks on information security specialists.

Linkedin for windows 10