Fake Cisco Job Posting Targets Korean Candidates
Cisco Talos have discovered that attackers leveraged a malicious Cisco job themed document based off of content from a legitimate Cisco job posting. A Microsoft Word document containing malicious macros was used to drop malware. The macros extract an encoded executable, drop it onto the file system, and execute it. Upon execution, the binary establishes a connection to a C2 server in order to receive an additional payload.
At the time of analysis, the second-stage payload was no longer available so the exact purpose of the final payload is unable to be determined. Cisco Talos researchers identified malware samples from 2017 that appear to be connected to this campaign. These additional samples were job-themed Word documents, used very similar encoding and obfuscation techniques and performed the same functions.
Cisco Talos believes that this campaign and the campaigns associated with the previous samples are likely connected to the same threat actor. Additionally, they note that the TTPs seen in the campaigns indicate a sophisticated attacker.
Indicators of Compromise
SHA256
- 1497ab6ddccf91ef7f2cd75ce020bb3bf39979210351deaa6e0025997ddfda5a
- 7af59922d4c1b4f2d589cb2853afb543b37a1f23da0cf0180a693f9748e05906
- 809b1201b17a77732be3a9f96a25d64c8eb0f7e7a826c6d86bb2b26e12da7b58
- adfb60104a6399c0b1a6b4e0544cca34df6ecee5339f08f42b52cdfe51e75dc3
- bf27c1631ef64c1e75676375a85d48f8ae97e1ea9a5f67c2beefc02c609fc18b
- cd2e8957a2e980ffb82c04e428fed699865542767b257eb888b6732811814a97
- e259aa1de48fd10b7601c4486b841428fbd6cd1a4752cf0d3bbe1799116ae6e6
Domains
Duncan is a technology professional with over 20 years experience of working in various IT roles. He has a interest in cyber security, and has a wide range of other skills in radio, electronics and telecommunications.