North Korea-linked APT group posed as Samsung recruiters is a spear-phishing campaign that targeted South Korean security companies that sell anti-malware solutions, Google TAG researchers reported.
According to the Google Threat Horizons report, the state-sponsored hackers sent fake job offers to employees at the security companies. Google TAG researchers reported that the same group, tracked as Zinc,” also
targeted security researchers in past campaigns.
“TAG observed a North Korean government-backed attacker group that previously targeted security researchers posing as recruiters at Samsung and sending fake job opportunities to employees at multiple South Korean information security companies that sell anti-malware solutions.”
reads the Google Threat Horizons report. “The emails included a PDF allegedly claiming to be of a job description for a role at Samsung; however, the PDFs were malformed and did not open in a standard PDF reader. When targets replied that they could not open the job description, attackers responded with a malicious link to malware purporting to be a “Secure PDF Reader” stored in Google Drive which has now been blocked.”
The attackers used a malformed PDF claiming to be a job description for a role at Samsung, for this reason, the recipient was not able to open it and contacted the sender that in turn provided him with a link to a “Secure PDF Reader” app. The app, which was stored in Google Drive, was a tainted version of the legitimate PDF reader PDFTron. Upon installing the app a backdoor is established on the victims’ devices.
securityaffairs.co
