Article Details
Scrape Timestamp (UTC): 2023-11-11 13:38:05.763
Source: https://thehackernews.com/2023/11/microsoft-warns-of-fake-skills.html
Original Article Text
Click to Toggle View
Microsoft Warns of Fake Skills Assessment Portals Targeting IT Job Seekers. A sub-cluster within the infamous Lazarus Group has established new infrastructure that impersonates skills assessment portals as part of its social engineering campaigns. Microsoft attributed the activity to a threat actor it calls Sapphire Sleet, describing it as a "shift in the persistent actor's tactics." Sapphire Sleet, also called APT38, BlueNoroff, CageyChameleon, and CryptoCore, has a track record of orchestrating cryptocurrency theft via social engineering. Earlier this week, Jamf Threat Labs implicated the threat actor to a new macOS malware family called ObjCShellz that's assessed to be a late-stage payload delivered in connection with another macOS malware known as RustBucket. "Sapphire Sleet typically finds targets on platforms like LinkedIn and uses lures related to skills assessment," the Microsoft Threat Intelligence team said in a series of posts on X (formerly Twitter). "The threat actor then moves successful communications with targets to other platforms." The tech giant said past campaigns mounted by the hacking crew involved sending malicious attachments directly or embedding links to pages hosted on legitimate websites like GitHub. However, the swift detection and deletion of these payloads may have forced Sapphire Sleet to flesh out its own network of websites for malware distribution. "Several malicious domains and subdomains host these websites, which entice recruiters to register for an account," the company added. "The websites are password-protected to impede analysis."
Daily Brief Summary
Microsoft's Security team identified a sub-group of the Lazarus Group targeting IT professionals with fake job assessment portals.
The threat actor, known as Sapphire Sleet, is engaging in sophisticated social engineering attacks to facilitate cryptocurrency theft.
Sapphire Sleet, with several aliases like APT38 and BlueNoroff, was recently linked to a newly discovered macOS malware, ObjCShellz.
Microsoft noted that Sapphire Sleet often entices victims via LinkedIn with opportunities that lead to malicious websites.
The group has adapted strategies, moving from using legitimate services like GitHub to custom-built phishing sites that are harder to analyze due to password protection.
Early detection and removal of malicious payloads from platforms have pushed the threat actors to develop their own infrastructure for malware dissemination.
To appear legitimate and avoid detection, Sapphire Sleet's phishing sites encourage recruiters to sign up, potentially compromising sensitive information.