1010.cx

  • Nimbus Manticore Attacking Defense and Telecom Sectors With New Malware

    ·

    , ,

    The Iranian threat actor known as Nimbus Manticore has intensified its campaign targeting defense manufacturing, telecommunications, and aviation sectors across Western Europe with sophisticated new malware variants.

    This mature advanced persistent threat group, also tracked as UNC1549 and Smoke Sandstorm, has evolved its tactics to include previously undocumented techniques for evading detection and maintaining persistence on compromised systems.

    Nimbus Manticore’s recent operations demonstrate a strategic shift toward European targets, particularly in Denmark, Sweden, and Portugal.

    The threat actor has refined its social engineering approach by impersonating legitimate aerospace giants including Boeing, Airbus, and Rheinmetall, as well as telecommunications companies like flydubai.

    Their deceptive career portal websites utilize React-based templates that closely mimic authentic hiring platforms, complete with pre-shared credentials for each targeted victim.

    The attack methodology begins with tailored spear-phishing campaigns where alleged HR recruiters direct victims to fake career portals.

    Each target receives unique URLs and login credentials, enabling the threat actors to track victim engagement and maintain controlled access throughout the infection process.

    This approach demonstrates sophisticated operational security measures and credible pretexting capabilities that align with nation-state tradecraft.

    Check Point analysts identified the malware’s deployment through an intricate multi-stage infection chain that exploits legitimate Windows processes.

    Infection chain (Source – Check Point)

    The initial payload, disguised as hiring-related software such as “Survey.zip,” contains multiple components including a legitimate Setup.exe file that initiates the sideloading sequence.

    The malware leverages a Windows Defender component called SenseSampleUploader.exe to execute its payload through DLL hijacking techniques.

    Multi-Stage DLL Sideloading Mechanism

    The infection chain employs a novel technique that manipulates the Windows DLL search order through undocumented low-level APIs.

    When the victim executes Setup.exe, the malware uses RtlCreateProcessParameters to modify the DllPath parameter in the RTL_USER_PROCESS_PARAMETERS structure.

    This manipulation enables the malicious xmllite.dll to be loaded from the archive directory rather than the expected system location.

    The contents of malicious ZIP archive (Source – Check Point)

    The userenv.dll component checks the executing process name to determine the infection stage. During initial setup, it uses low-level ntdll API calls to launch the Windows Defender binary located at C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe.

    The malware exploits this legitimate executable’s vulnerability to DLL hijacking, forcing it to load the malicious xmllite.dll from the same folder as the archive.

    Once loaded, the xmllite.dll creates a working directory at %AppData%\Local\Microsoft\MigAutoPlay\ and copies the backdoor components for persistence.

    The malware establishes a scheduled task to execute MigAutoPlay.exe, which then sideloads the malicious userenv.dll containing the primary backdoor functionality.

    This technique effectively bypasses traditional security controls by leveraging trusted Windows processes.

    The evolution of the malware, now tracked as MiniJunk, incorporates substantial compiler-level obfuscation techniques that render samples nearly irreversible for standard static analysis.

    The threat actors have implemented custom LLVM passes that introduce junk code insertion, control-flow obfuscation, opaque predicates, and encrypted strings. Each string receives individual encryption with unique keys, while function calls undergo arithmetic operations to obscure their actual destinations.

    Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

    The post Nimbus Manticore Attacking Defense and Telecom Sectors With New Malware appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Top 10 Best Penetration Testing Companies in 2025

    ·

    , ,

    Penetration testing companies play a vital role in strengthening the cybersecurity defenses of organizations by identifying vulnerabilities in their systems, applications, and networks. These firms simulate real-world cyberattacks to uncover weaknesses that could be exploited by malicious actors, helping businesses implement proactive security measures. They provide services tailored to various industries, including web application security, […]

    The post Top 10 Best Penetration Testing Companies in 2025 appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Hackers Weaponizing SVG Files to Stealthily Deliver Malicious Payloads

    ·

    , ,

    Cybercriminals have embraced a new deceptive technique that transforms seemingly harmless vector graphics into dangerous malware delivery systems.

    A recent campaign targeting Latin America demonstrates how attackers are exploiting oversized SVG files containing embedded malicious payloads to distribute AsyncRAT, a potent remote access trojan capable of comprehensive system compromise.

    The campaign begins with carefully crafted phishing emails impersonating legitimate institutions, particularly judicial systems, to create urgency around fictitious legal proceedings or court summons.

    Victims receive messages claiming lawsuits or official documents require immediate attention, compelling recipients to open attached SVG files without proper scrutiny.

    Unlike traditional malware campaigns that require external command-and-control infrastructure, these weaponized SVG files contain complete malicious packages within themselves.

    The technique, known as SVG smuggling, leverages the XML-based nature of Scalable Vector Graphics to embed scripts, interactive elements, and encoded payloads directly into what appears to be an innocent image file.

    XML file used in the campaign (Source – Welivesecurity)

    Welivesecurity analysts noted that these files often exceed 10 MB in size, far larger than typical graphics, and immediately render fake government portals when opened in web browsers.

    The attackers appear to utilize artificial intelligence tools to generate customized files for individual targets, with each victim receiving uniquely crafted SVG files stuffed with randomized data to evade signature-based detection systems.

    Infection Mechanism and Payload Deployment

    The infection process unfolds through a sophisticated multi-stage workflow designed to maintain victim engagement while downloading malicious components.

    When users click the SVG attachment, their default web browser renders an elaborate fake portal mimicking Colombia’s judicial system, complete with official logos, government styling, and dynamic progress indicators.

    The malicious SVG file contains embedded JavaScript that simulates document verification processes, displaying realistic progress bars and status messages like “Verificando documentos oficiales” and “30% completado” to create authenticity.

    During this theatrical display, the script quietly assembles and deploys a password-protected ZIP archive containing the final AsyncRAT payload.

    The embedded code includes base64-encoded binary data that gets decoded and assembled on-the-fly:-

    const payloadData = "UESDBBQACQgIAGxD+VpRqIWSufYYACn8GAAxAAAAMDFfREVNQU5EQSBQRU5BTCBQT1IgRUwgSlVaR0FETyAwMS...";
const binaryString = atob(payloadData);
const bytes = new Uint8Array(binaryString.length);

    The campaign employs DLL sideloading techniques where legitimate applications load malicious libraries, allowing the final AsyncRAT payload to blend with normal system processes and evade detection.

    Detection telemetry reveals systematic deployment patterns, with attack spikes occurring mid-week throughout August 2025, primarily targeting Colombian users.

    Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

    The post Hackers Weaponizing SVG Files to Stealthily Deliver Malicious Payloads appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • U.S. Secret Service Seizes 300 SIM Servers, 100K Cards Threatening U.S. Officials Near UN

    ·

    The U.S. Secret Service on Tuesday said it took down a network of electronic devices located across the New York tri-state area that were used to threaten U.S. government officials and posed an imminent threat to national security. “This protective intelligence investigation led to the discovery of more than 300 co-located SIM servers and 100,000 SIM cards across multiple sites,” the Secret

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The D Brief: China’s global challenge; NATO on Russian incursions; Estonia’s requests; Germany’s big arms plan; And a bit more.

    ·

    China’s accumulation of military facilities and partnerships beyond the Indo-Pacific region mean U.S. forces must innovate more urgently, air and space intelligence officials said Monday. 

    “The China challenge is not just a challenge for INDOPACOM,” Lt. Gen. Max Pearson, Air Force deputy chief of staff for intelligence, said during a panel discussion at AFA’s Air, Space, and Cyber conference. “In addition to the support base in Djibouti … the PLA continues to pursue military installations, [cooperative agreements], and partnerships in a lot of places. I mean, we're seeing this across Asia, in the Middle East, Africa, across the Pacific. And we're seeing the PLA partnering with others: strategic bomber patrols with Russia, naval patrols with Russia, as well as exercises—PLA, Russia and Iran.” 

    Meanwhile, the Chinese navy launched next-generation fighter and early warning aircraft on test flights from its Fujian aircraft carrier Monday, weeks after Beijing rolled out new weapons at a giant military parade earlier this month.

    Related: “Marines showcase ship-killing NMESIS missile system in Japan,” as part of island-defense exercises, Task & Purpose reported Sunday.

    Anduril blames CCA delay on push for ‘semi-autonomous’ first flight. The Air Force had anticipated that Anduril’s prototype collaborative combat aircraft, dubbed YFQ-44 Fury, would fly this summer, but only General Atomics’ rival YFQ-42A actually took off. “The goal is to also get to a semi-autonomous first flight, which means takeoff and landing will be done via push of a button,” Anduril vice president Diem Salmon told reporters at the AFA show on Monday. A General Atomics spokesman noted that their YFQ-42A is also designed for semi-autonomous flight, although its August test did not use it. Defense One’s Thomas Novelly has a bit more, here.

    ICYMI: F-47’s first flight expected in 2028, a year earlier than officials had previously suggested. Novelly reported off Monday’s keynote by Air Force Chief of Staff Gen. David Allvin, here.

    Update: The U.S. Army released the names of four soldiers who perished in an MH-60 helicopter crash Wednesday in Washington state. They include: 

    • Chief Warrant Officer Three Andrew Cully, 35, from Sparta, Missouri;
    • Chief Warrant Officer Three Andrew Kraus, 39, from Sanibel, Florida;
    • Sgt. Donavon Scott, 24, from Tacoma;
    • And Sgt. Jadalyn Good, 23, from Mount Vernon, Washington. 

    All four were assigned to the 160th Special Operations Aviation Regiment, based at Joint-Base Lewis-McChord, just outside Tacoma. It’s unclear how the crash occurred, but officials from Fort Rucker’s Army Combat Readiness Center have been sent to investigate, Stars and Stripes reports. 

    Additional reading: 

    Welcome to this Tuesday edition of The D Brief, a newsletter dedicated to developments affecting the future of U.S. national security, brought to you by Ben Watson with Bradley Peniston. It’s more important than ever to stay informed, so thank you for reading. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day in 1957, President Dwight D. Eisenhower ordered the 101st Airborne Division to Little Rock, Arkansas, and federalized the Arkansas National Guard to support and protect the integration of Little Rock Central High School.

    Americas

    First indication of evidence from Trump’s war on drug cartels? U.S. and Dominican Republic officials have pulled 13 bales containing more than 370 packages of “suspected cocaine” from the waters of the Caribbean Sea near a site where the U.S. military recently destroyed a boat suspected of trafficking drugs, several outlets—including the New York Times, Associated Press, and the Wall Street Journal—reported Monday (gift link). 

    Video of the recovered packages can be seen in a Sunday press conference from Dominican authorities, here. 

    It’s unclear when the boat was destroyed, but President Trump has claimed to have ordered the military to attack at least three such alleged drug-trafficking boats this month—the first on Sept. 2, the next on Sept. 15, and the latest on Sept. 19. 

    Context: “Human rights groups have said the strikes on the boats amount to extra judicial killings, and on Friday two Democratic senators introduced a resolution in Congress that seeks to block the administration from carrying out further strikes,” AP writes. 

    “The speedboat was en route to the Dominican Republic and those on board planned to use the country as a bridge before smuggling the drugs to the U.S.,” the Journal reports, citing officials from the Dominican Republic’s National Directorate for Drug Control. The newspaper did not disclose how the officials made that determination, nor did Dominican officials share any new information on those on the boat when they were killed by the U.S. military. 

    A new report says China’s military diplomacy is taking off in Latin America. That includes an increase in students from the region “enrolled in Chinese military colleges, which was more than five times the number in the United States starting in 2020,” researchers from the Washington-based Center for Strategic and International Studies write in a report published Monday. 

    Russia, meanwhile, has leaned more on its “soft power” in the region, since the majority of its military is bogged down in a Ukraine invasion that has turned into a grinding war of attrition. 

    Still, “For now, Washington remains the preferred defense partner for many [Latin American] countries,” the report says. But more could be done, like “Working with Major Non-NATO Allies like Argentina, Brazil, and Colombia to streamline arms procurement processes and encourage greater interoperability with U.S. forces can help to minimize the appeal of Beijing or Moscow’s offers.” Read the rest, here. 

    Less than two weeks after Brazil’s former president Jair Bolsonaro was convicted of attempting a coup in 2022, the U.S. Treasury Department on Monday announced sanctions against Viviane Barci de Moraes—who is the wife of Alexandre de Moraes, the Brazilian Supreme Court justice who oversaw Bolsonaro’s prosecution. 

    Trump’s State Department alleges Justice Moraes “weaponize[d] courts, authorize[d] arbitrary pretrial detentions, and suppress[ed] freedom of expression” in Brazil.  

    Brazil’s POV: The U.S. sanctions are “a new attempt of undue interference in Brazilian internal affairs,” Brazil’s government said in a statement. It also alleges “the U.S. government tried to justify the adoption of the measure with falsehoods” in an effort to “politicize” and “distort…the Brazilian judiciary’s efforts to defend democratic institutions and uphold rule of law.” 

    Reuters: “The new sanctions underline Trump's use of financial penalties for political ends.”

    Europe

    NATO officials met Tuesday to discuss Russia’s violation of Estonia’s airspace on Friday when three armed Russian MiG-31 aircraft flew over the eastern European nation for more than ten minutes amid Moscow’s ongoing invasion of Ukraine. Estonia requested the alliance meeting, in accordance with Article 4, a move Poland also requested when a similar development involving Russian drones occurred less than two weeks ago. 

    “Several other Allies—including Finland, Latvia, Lithuania, Norway, and Romania—have also recently experienced airspace violations by Russia,” NATO’s North Atlantic Council said in a statement Tuesday. “Russia bears full responsibility for these actions, which are escalatory, risk miscalculation and endanger lives. They must stop.”

    “Allies will not be deterred by these and other irresponsible acts by Russia from their enduring commitments to support Ukraine, whose security contributes to ours, in the exercise of its inherent right to self-defence against Russia’s brutal and unprovoked war of aggression,” the council members added. 

    Estonia calls on NATO to expand air patrols and other defense measures under the alliance's new Eastern Sentry effort, Defense One’s Patrick Tucker reported Monday from Tallinn. 

    Germany’s 80-billion-euro rearmament plan mostly skips U.S. weapons, Politico reports off budget documents submitted to the German parliament. Just 8 percent of the total is slated to buy U.S.-made arms, with the lion’s share headed to European companies. “That's a blow for Donald Trump, who has been putting pressure on European countries to continue buying U.S. arms despite the geopolitical turmoil emanating from the White House,” Politico reported Tuesday. More details, here.

    Trump 2.0

    President Trump wants to prosecute Americans who openly oppose fascism in a new executive order entitled, “DESIGNATING ANTIFA AS A DOMESTIC TERRORIST ORGANIZATION.” 

    According to Trump, “Antifa is a militarist, anarchist enterprise that explicitly calls for the overthrow of the United States Government, law enforcement authorities, and…uses illegal means to organize and execute a campaign of violence and terrorism nationwide to accomplish these goals.” 

    He also claims its members “obstruct enforcement of Federal laws through armed standoffs with law enforcement, organized riots, violent assaults on Immigration and Customs Enforcement and other law enforcement officers, and routine doxing of and other threats against political figures and activists.” Trump’s new order directs federal agencies to “investigate, disrupt, and dismantle” Antifa and its financial supporters wherever they can be found. 

    For the record: Trump “issued a domestic terrorism designation that doesn’t exist under U.S. law,” the New York Times reported after the order was made public Monday. The Times calls the group “a diffuse and sometimes violent protest culture of left-wing activists who want to stop the far right” after taking “its name and iconography from the antifascist movement that opposed the Nazi Party and other far-right political parties in the 1920s and 30s.”

    Another consideration: “Antifa does not have a leader that could be targeted, a roster of known members, bank accounts to freeze or a centralized structure,” the Times reports. The BBC has more, here. 

    Related reading/viewing: 

    Why is there no Coast Guard commandant yet? At least partly because Homeland Security Secretary Kristi Noem lives in the commandant’s house and “she doesn’t want to get kicked out,” Ben Terris of New York Magazine reminded readers in a lengthy Monday profile of the Homeland Security Department under Noem, with an eye on her influential chief of staff and alleged romantic partner Corey Lewandowski. 

    Reminder: Adm. Kevin Lunday has been acting commandant since Trump’s inauguration.

    Reminder: Noem is “overseeing a massive influx of some $170 billion that Republicans set aside for combating illegal immigration, money that will go toward expanding DHS’s detention capacity to 100,000 beds (ICE is currently holding more than 58,000 detainees), increasing the size of ICE (in part by offering up to $50,000 in signing bonuses and eliminating the age cap on new hires), bolstering law-enforcement border support, and underwriting a propaganda campaign that has clogged social media with everything from Zero Dark Thirty–style PSAs to paeans to white-nationalist mythology,” Terris reports. 

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Tata-Owned Jaguar Land Rover Delays Factory Reopening Following Major Cyber Attack

    ·

    , , ,

    Jaguar Land Rover (JLR), the United Kingdom’s largest automotive manufacturer, has announced an additional delay in resuming production at its factories following a significant cyber-attack that occurred earlier this month.

    The company has extended its current production pause until Wednesday, October 1, 2025, as it continues to manage the fallout from the security incident and carefully plans for a secure resumption of its manufacturing lines.

    The decision to prolong the shutdown was communicated to employees, suppliers, and partners to provide them with clear guidance for the week ahead.

    In a recent statement, JLR explained that this extension is crucial for developing a detailed timeline for the “phased restart of our operations.”

    The company is using this period to advance its ongoing investigation into the breach, aiming to understand the full scope of the attack and fortify its systems against future threats.

    This methodical approach underscores the complexity of recovering from a sophisticated cyber intrusion that has impacted a major global manufacturing operation.

    In response to the crisis, JLR has mobilized its internal teams to work around the clock. They are collaborating closely with external cybersecurity specialists, the UK’s National Cyber Security Center (NCSC), and law enforcement agencies.

    The primary objective of this joint effort is to ensure that when production does restart, it is done in a “safe and secure manner.”

    The incident highlights the growing threat of cyber-attacks on critical industrial sectors, where operational technology and IT systems are increasingly interconnected, creating a broader attack surface for malicious actors.

    Throughout this challenging period, JLR has emphasized its commitment to its network of stakeholders. The company stated, “Our focus remains on supporting our customers, suppliers, colleagues, and our retailers, who remain open.”

    While production lines are idle, the customer-facing parts of the business, including sales and service, continue to operate.

    JLR acknowledged the strain the situation has placed on everyone connected with the company, expressing gratitude for their “continued support and patience.”

    The full financial and operational impact of the prolonged shutdown is yet to be determined, but the incident serves as a stark reminder of the significant disruption cyber threats can inflict on the automotive industry.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Tata-Owned Jaguar Land Rover Delays Factory Reopening Following Major Cyber Attack appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • SonicWall Releases Urgent Update to Remove Rootkit Malware ‘OVERSTEP’ from SMA Devices

    ·

    , , ,

    SonicWall has issued an urgent firmware update, version 10.2.2.2-92sv, for its Secure Mobile Access (SMA) 100 series appliances to detect and remove known rootkit malware.

    The advisory, SNWLID-2025-0015, published on September 22, 2025, strongly recommends that all users of SMA 210, 410, and 500v devices apply the update immediately to protect against persistent threats.

    This release introduces additional file-checking capabilities designed to purge malicious software from compromised systems.

    The update directly addresses threats highlighted in a July 2025 report from Google’s Threat Intelligence Group (GTIG). Researchers detailed a campaign by a threat actor, tracked as UNC6148, deploying the OVERSTEP malware on end-of-life (EoL) SonicWall SMA 100 devices.

    OVERSTEP is a sophisticated user-mode rootkit that enables attackers to maintain persistent access through hidden components, establish a reverse shell, and exfiltrate sensitive data.

    Stolen files can include credentials, One-Time Password (OTP) seeds, and certificates, granting the attackers long-term persistence even after firmware updates.

    Patch Following Active Exploitation

    The release of this firmware is a critical step in combating active exploitation in the wild. The GTIG report noted that the OVERSTEP rootkit was deployed on SMA devices nearing their end-of-support date of October 1, 2025.

    While Google’s researchers could not definitively determine the initial access vector, they observed significant overlaps between UNC6148’s activities and incidents involving Abyss ransomware. In previous attacks, threat actors installed web shells on SMA appliances to maintain their foothold despite system updates.

    SonicWall’s advisory acknowledges the risks outlined by Google and urges administrators to implement the security measures detailed in a related July knowledge base article.

    The company has been actively addressing a series of vulnerabilities in its SMA 100 appliances throughout the year. In May 2025, it patched three flaws (CVE-2025-32819, CVE-2025-32820, CVE-2025-32821) that could be chained for remote code execution. Another critical flaw, CVE-2025-40599, was patched in July to prevent authenticated arbitrary file uploads.

    SonicWall emphasizes that this new firmware is the primary remediation for affected devices running versions 10.2.1.15-81sv and earlier. There is no workaround available.

    The advisory clarifies that the vulnerability does not impact the SonicWall SSL VPN SMA 1000 series or SSL-VPN functionality running on its firewalls.

    Given the active threats and the approaching end-of-support date for the SMA 100 series, organizations are advised to prioritize this update to prevent compromise and data exfiltration.

    Before upgrading, administrators should review appliance logs for indicators of compromise, reset all credentials, and reinitialize OTP bindings as a precautionary measure.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post SonicWall Releases Urgent Update to Remove Rootkit Malware ‘OVERSTEP’ from SMA Devices appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Threat Actors Breach Enterprise Infrastructure Within 18 Minutes of Initial Access

    ·

    ,

    Attackers are accelerating their foothold in corporate networks: over the past three months (June 1 to August 31, 2025), the average time from initial breach to lateral movement—called “breakout time”—fell to just 18 minutes. In one striking incident, “Akira” ransomware operators moved laterally in only six minutes after compromising a SonicWall VPN. This rapid pace […]

    The post Threat Actors Breach Enterprise Infrastructure Within 18 Minutes of Initial Access appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • U.S. Secret Service Shuts Down 300 SIM Servers and 100K SIM Cards Disabling Cell Towers

    ·

    ,

    The U.S. Secret Service has dismantled a sophisticated network of electronic devices scattered across the New York tri-state area. These devices posed an imminent threat to protective operations for senior government officials. During a protective intelligence investigation, agents identified over 300 co-located SIM servers and 100,000 SIM cards deployed at multiple locations. The servers and […]

    The post U.S. Secret Service Shuts Down 300 SIM Servers and 100K SIM Cards Disabling Cell Towers appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Threat Actors with Fake Job Lures Attacking Job Seekers to Deploy Advanced Malware

    ·

    , ,

    In recent months, a sophisticated campaign has emerged in which state-linked threat actors are leveraging fake job offers to ensnare unsuspecting job seekers and deliver advanced malware.

    These attackers craft convincing phishing emails that direct victims to look-alike career portals, impersonating leading aerospace and defense firms.

    The lure often begins with a personalized outreach on professional networks, complete with detailed job descriptions and branded graphics, before guiding candidates to enter credentials on counterfeit login pages.

    Once authenticated, the site delivers a malicious archive containing bespoke implants that establish stealthy footholds on victims’ machines.

    Check Point analysts noted that the evolution of this operation represents a marked shift from mass-market phishing to tightly controlled, per-target engagements.

    By registering domains behind privacy services and provisioning each victim with unique credentials, the attackers maintain operational security and minimize detection.

    The malicious payloads are delivered only after successful authentication, ensuring that security researchers cannot easily uncover the sites through generic crawling.

    Emerging variants of the malware, dubbed MiniJunk and MiniBrowse by researchers, incorporate modular architectures with obfuscation layers that thwart static and dynamic analysis.

    MiniJunk focuses on long-term persistence: it modifies Windows API calls to load malicious DLLs from alternate paths, a technique that bypasses common antivirus heuristics.

    Meanwhile, MiniBrowse silently harvests web session cookies, browser history, and saved credentials before exfiltrating the data over encrypted channels.

    The impact of these campaigns extends beyond individual compromise. Targeted organizations span the Middle East and Europe, including critical sectors such as telecommunications, aerospace, and defense contracting.

    In one intercepted attempt, a candidate applying for an engineering role at a European aerospace firm unwittingly deployed a SlugResin-derived payload that established a reverse shell connection within seconds of execution.

    Through these infections, threat actors gain persistent access to corporate networks, opening pathways for espionage, intellectual property theft, and subsequent lateral movement.

    Infection Mechanism and DLL Hijacking

    At the core of the MiniJunk variant lies a refined DLL hijacking strategy that subverts legitimate Windows processes.

    After initial execution, the loader modifies the process’s search path by patching the PEB (Process Environment Block), redirecting DLL resolution to attacker-controlled directories.

    The following pseudocode illustrates the key steps:-

    // Patch PEB to redirect DLL search
PPEB peb = NtCurrentTeb()->ProcessEnvironmentBlock;
UNICODE_STRING evilPath = RTL_CONSTANT_STRING(L"C:\\Users\\Public\\WinSys\\");
peb->ProcessParameters->DllDirectory = evilPath;

// Load target process with hijacked DLLs
STARTUPINFO si = {0};
PROCESS_INFORMATION pi;
CreateProcessW(L"C:\\Windows\\System32\\svchost.exe", NULL, NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &si, &pi);
ResumeThread(pi.hThread);

    This technique ensures that when svchost.exe or similar trusted binaries initialize, they load malicious libraries instead of legitimate system DLLs.

    The infection chain (Source – Check Point)

    By embedding the loader within a seemingly benign executable, the attackers achieve stealth and persistence without raising immediate alarms on endpoint security tools.

    Organizations should enforce strict code integrity policies and monitor unusual DLL load behaviors to detect and mitigate such attacks.

    Continuous analysis of process injection patterns and validation of DLL search paths will be critical defenses against this emerging threat.

    Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

    The post Threat Actors with Fake Job Lures Attacking Job Seekers to Deploy Advanced Malware appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶