The Growth in Job Posting Spear Phishing Techniques: A Case Study

Or Shichrur & Yuval Shnitzer

In recent years, fake job hiring scams have become a common form of social engineering. Threat actors use these scams to steal money, launder money, commit identity theft, or carry out other fraudulent or illegal activities.

The motives of threat actors behind fake job hiring scams vary. Some are simply looking to make a quick buck, while others are more interested in stealing personal information or committing identity theft. Still others use these scams to carry out more complex fraudulent or illegal activities.

Fake recruiters often use catfishing tactics to lure jobseekers into scams. They offer lucrative jobs, only to deceive applicants and perpetrate malicious activities such as malware installation, monetary theft, or identity theft.

These scammers don’t target just anyone. They specifically target vulnerable jobseekers, such as people who are unemployed or who are looking for work-from-home opportunities.

As technology advances, threat actors’ methods evolve as well. Trojan viruses are one of their most powerful tools. The amount of malware circulating online is increasing exponentially, and spear phishing is becoming an increasingly popular way to deploy malicious software.

This case study by Cyberint provides an in-depth look at the dangers posed by Trojan viruses. It offers valuable insights into the challenges organizations face in combating these cyber threats and impersonations. The study also reveals the presence of multiple Trojan horses camouflaged within ZIP files, which specifically target and impersonate certain companies in order to exploit employees and job applicants.

Spear Phishing Technique: Fake Job Listings & Exposed Files

Cyberint detected a spear phishing and information theft pattern online in the form of fake job listings or exposed internal corporate files. Many malicious applications (disguising themselves as PDF, XLS, and DOC files by altering their icons) were discovered, potentially impersonating hundreds of companies. Those files are distributed as a ZIP file and target employees or job applicants with promising titles such as “Job Plan Description for the Position of Director” or “Salary and Benefits”.

Additionally, the applications were sophisticatedly disguised among “legitimate” company-related files, such as images or videos.

Fake Job Listing Victimology

Below is a list of multiple companies’ descriptions, among many others, which were found to be targeted by this campaign:

• One of the largest Japanese multinational conglomerate corporations, known for its electronics
• An elite Italian luxury fashion house
• A leading French cosmetics and the world’s largest personal care company
• An American worldwide clothing retailer, especially known for its jacket and jeans
• A prestigious Italian luxury fashion house, very known for its producing fur, leather goods, shoes, fragrances, eyewear, etc.
• A renowned Italian luxury clothing company

Metadata Analysis

Furthermore, upon file inspection Cyberint identified identical information about the threat actor across multiple files’ properties. Cyberint was able to uncover findings related to the Metadata of the executable file.

A direct translation of the signer’s name (Cong Ty Tnhh Cao Su Minh Khang) is “Minh Khang Rubber Co., Ltd”, which raised suspicions of it being a shell company. However, further investigation using the email indicated that the threat actor could be named “Hung Ta Duc”. We believe that additional information is yet to be uncovered.

IP Traffic Examination and Digital Forensics

During the forensics investigation it was apparent that the ZIP files were downloaded from OneDrive. The threat actors abuse OneDrive’s authenticity to gain credibility to deceive the victims. Threat actors commonly use OneDrive, Dropbox, and SharePoint in social engineering campaigns. Shortly after the campaign began, the items disappeared from OneDrive, which may indicate an attempt by the threat actor to conceal their tracks. After executing the EXE files, the malware generates additional files that can affect the operating system.

In addition, multiple Antivirus scanners deemed the type of these malware to be Ducktail. The Ducktail info stealer malware is developed using .NET Core. Threat actors using this malware employ Telegram as a platform for Command-and-Control Communication (C&C) and data exfiltration. C&C Communication is a technique used by threat actors to establish control over compromised devices via network communication. When executed by the victim, the malware additionally scans for installed browsers on the compromised device to extract stored cookies and other relevant data.

Telegram Bot

During the forensic analysis, it was clear that the malicious applications generated multiple files on the compromised machine. Notably, one of these files appears to be linked to a Telegram Bot, implying that it may serve as the channel through which the threat actor acquires information from the compromised system. This could potentially be utilized for C&C communications. Further analysis revealed that the extracted malware also engages in communication with certain domains and IP addresses.