Table of Contents

Cyberthreat Analysis

• New Bumblebee Malware Campaign Targets IT Staff Through Typosquatting Tactics
• Threat Actors Are Hijacking Google AI Search Results to Deliver Malware Payloads
• North Korean Cyber Campaign Targets Job Seekers with Fake Interview Links

Industry News

#NMFTACyber On Demand

New Bumblebee Malware Campaign Targets IT Staff Through Typosquatting Tactics

A new Bumblebee malware campaign has been identified which utilized search engine optimization (SEO) poisoning and typosquatting techniques to mimic open-source projects in order to target information technology (IT) staff. The group utilized tools commonly used by IT staff to diagnose or analyze network traffic such as Zenmap and WinMTR. The threat actor developed clone websites that like the legitimate domain to trick IT workers into downloading malware onto their company networks. When interacted with, the fictitious site downloaded and delivered the intended packages as well as a trojanized malicious dynamic link libraries (DLL) which dropped the Bumblebee loader.

This campaign relies heavily on the notoriety of the programs it mimics as well as social engineering techniques to seem legitimate. The threat actor clearly has significant experience and skill coding in order to develop such a convincing fake site that successfully fooled IT specialists that regularly use the programs. Additionally, the malware exhibited sophisticated obfuscation capabilities in order to evade system detection upon download. Ensuring all domains are free from errors and have been verified can disrupt typosquatting campaigns and protect internal systems from compromise.

Threat Actors Are Hijacking Google AI Search Results to Deliver Malware Payloads

Threat actors have utilized Google's search functions to hijack searches for AI tools by developing AI-themed websites laced with infostealer malware. Upon interaction with the fake website, the page deploys JavaScript to fingerprint the browser and collect browser information. The visitor is then redirected to a malicious web page that includes various malware infostealer downloads. The redirection logic is hosted on AWS servers, which allows the malicious program to evade scanning detection. The campaign utilizes the current interest in AI development and often mimics the websites of large AI development brands Luma AI and ChatGPT. Most of the malicious sites were developed using the WordPress program and are search engine optimized (SEO) to attract more web traffic, expanding their targeting pool. 

This campaign includes both sophisticated obfuscation and social engineering techniques. Given the new developments in the AI space, people are often unfamiliar with certain brands, allowing threat actors to take advantage of the average person's inexperience. Additionally, by utilizing legitimate systems and SEO techniques, the malicious sites can evade detection and gain legitimacy within Google’s search function increasing the likelihood of interaction. This mixture of social engineering, and system manipulation makes this campaign difficult to track and extremely effective. Checking all URLs carefully for signs of tampering such as typo squatting and unrecognized subdirectories can aid a user in identifying suspicious links

North Korean Cyber Campaign Targets Job Seekers With Fake Interview Links

North Korea initiated a new wave of cyberattacks dubbed “Contagious Interview," in which job seekers are targeted with fictitious job interview links. The links contain malicious node package manager (NPM) software packages that include info stealer malware and backdoors for future deployments. The latest wave of attacks utilizes 35 malicious packages uploaded to NPM through 24 accounts. As of this writing, there are over 4,000 downloads associated with these malicious packages. The packages are typically delivered to software engineers through North Korean operatives masquerading as job recruiters and are disguised as “coding assignments” for the applicants to complete as part of an interview process. 

North Korean threat actors have been known for many years to engage in fake job application attacks. During the COVID-19 pandemic, North Korean agents would apply for remote jobs in order to infiltrate company networks to deploy malware. As these attacks have developed, they have begun to expand targeting to job applicants, especially those engaged in coding, IT, web development, and crypto. The packages typically contain info stealer malware, as well as modified backdoors, so that the threat actor can continue to steal data over a longer span of time, thus gaining access to multiple accounts to conduct further attacks. These tactics fall in line with known North Korean tactics, techniques, and procedures (TTPs) and targeting practices. Confirming the legitimacy of any downloads sent by a third party can protect against malware deployments.

Refer a Colleague

Would you like others at your company to be added to the NMFTA Headline Newsletter email distribution list? Send them this link or fill out the form for them on their behalf below!