IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Lazarus hackers target engineers using malware-laced job ads

The notorious hacking group has returned with a new phishing campaign in the US and Europe

Security researchers have discovered a new phishing campaign targeting engineering job candidates and employees in classified engineering roles within the US and Europe. 

According to a blog post by researchers at AT&T Cybersecurity, the activity has been attributed to the Lazarus hacking group and has been active over the last few months.

Researchers said that several documents were identified by Twitter users between May to June 2021 as being linked to the Lazarus group. Documents observed in previous campaigns lured victims with job opportunities for Boeing and BAE systems. 

These documents attempted to impersonate new defense contractors and engineering companies like Airbus, General Motors (GM), and Rheinmetall. All of these documents contain macro malware, which has been developed and improved during the course of this campaign and from one target to another, according to the researchers.

“The core techniques for the three malicious documents are the same, but the attackers attempted to reduce the potential detections and increase the faculties of the macros,” they said.

The first two documents from early May 2021 were related to a German Engineering company focused on the defense and automotive industries, Rheinmetall. A second malicious document appears to include more elaborate content, which may have resulted in the documents going unnoticed by victims.

Related Resource

The secure cloud configuration imperative

The central role of cloud security posture management

The secure cloud configuration imperativeFree download

After the Rheinmetall document was observed, a similar document emerged targeting General Motors. The characteristics of this  were very similar to the previous one, but with minor updates in the C&C communication process, according to researchers.

In early June, a month after the first document of this campaign was observed, a new one was identified targeting Airbus. This time, the C&C communications were very similar to the previous iteration of the document; however, the execution and injection processes were different.

Researchers said that this new activity was in line with the Lazarus’ past campaigns and is not expected to be the last.

“Attack lures, potentially targeting engineering professionals in government organizations, showcase the importance of tracking Lazarus and their evolution," they said. 

"We continue to see Lazarus using the same tactic, techniques, and procedures that we have observed in the past, such as using Microsoft Office documents that download remote templates, Microsoft Office Macros, and compromised third party infrastructure to host the payloads and proxy C&C traffic through."

Featured Resources

Activation playbook: Deliver data that powers impactful, game-changing campaigns

Bringing together data and technology to drive better business outcomes

Free Download

In unpredictable times, a data strategy is key

Data processes are crucial to guide decisions and drive business growth

Free Download

Achieving resiliency with Everything-as-a-Service (XAAS)

Transforming the enterprise IT landscape

Free Download

What is contextual analytics?

Creating more customer value in HR software applications

Free Download

Recommended

Mastering endpoint security implementation
Security

Mastering endpoint security implementation

18 May 2022
The Total Economic Impact™ of Apple Mac in Enterprise: M1 update
Whitepaper

The Total Economic Impact™ of Apple Mac in Enterprise: M1 update

12 May 2022
Dell Technologies World 2022: Dell unveils fastest storage architecture in company history
Server & storage

Dell Technologies World 2022: Dell unveils fastest storage architecture in company history

4 May 2022
Dell Technologies World 2022: Dell unveils security offerings for major cloud providers
public cloud

Dell Technologies World 2022: Dell unveils security offerings for major cloud providers

3 May 2022

Most Popular

Europe's first autonomous petrol station opens in Lisbon
automation

Europe's first autonomous petrol station opens in Lisbon

23 May 2022
16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

13 May 2022
Nvidia pauses hiring to help cope with inflation
Careers & training

Nvidia pauses hiring to help cope with inflation

23 May 2022