North Korean hackers may be trying to phish the IT security community by pretending to be cybersecurity researchers.
On Monday, Google released an alarming report that says a state-sponsored group from the country is likely posing as cybersecurity experts on social media. Using over a dozen accounts on Twitter and LinkedIn, they've pretended to be independent researchers and a security firm called BrownSec3 Labs.
According to Google, the North Korean hackers built up the fake accounts over several months in order to phish legitimate security researchers. Through the accounts and chat services such as Discord and Telegram, the hackers asked other researchers to collaborate in an attempt to trick them into downloading malware.
The attack occurred when the hackers encouraged researchers to install a Visual Studio Project. In reality, the software contained a custom DLL file capable of secretly executing commands from a hacker-controlled server.
The hackers also phished victims via a fake research blog that could deliver malware to unsuspecting cybersecurity researchers, even if their PCs were running the latest version of Windows 10 and Google’s Chrome browser.
“In each of these cases, the researchers have followed a link on Twitter to a write-up hosted on blog.br0vvnn[.]io, and shortly thereafter, a malicious service was installed on the researcher’s system and an in-memory backdoor would begin beaconing to an actor-owned command and control server,” Google said.
How the hackers pulled this off remains unknown, prompting security experts to scramble to find out if they ever visited “blog.br0vvnn[.]io” and became infected.
In the meantime, Google is asking the security community for any information on possible vulnerabilities in Windows 10 and Chrome. “To date, we have only seen these actors targeting Windows systems as a part of this campaign,” the company added.
To build up the fake accounts’ credibility, the hackers posted write-ups and analysis on software vulnerabilities. But at least in one case, involving a purported Windows Defender vulnerability, the research was a sham.
Google hasn’t explained how it attributed the attacks to North Korea. But a researcher at Kaspersky Lab points out the malware used in the Visual Basic Project contains similarities with other attacks from the Lazarus group, which was famously blamed for the Sony Pictures breach in 2014 and the WannaCry attack in 2017.