Lazarus targeted South Korean organizations with spear-phishing emails that linked to fake, tailored résumé, portfolio, and interior-design websites. Visiting the sites likely triggered an infection through commonly required financial-security software, allowing the attackers to install malware while leaving very little evidence on the computer.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
A résumé tailored to your team? That’s the hook. Lazarus emailed South Korean teams: ‘Please review this senior network appliance developer’s résumé and portfolio.’ The link opened a tailored GitHub Pages site, later swapped for an interior-design showcase. Here’s the catch: just visiting likely started an infection through CrossWeb EX financial-security software. The profile had an unnatural-looking photo, a John Doe-like name, and meaningless portfolio details. A polished portfolio isn’t proof. Got an unexpected applicant link? Report the email without opening it.
A state-sponsored campaign in South Korea used spear-phishing and hacked “trusted” local websites to infect visitors who had vulnerable AnySign4PC installed. In some cases, simply visiting a compromised page triggered the exploit and installed SIGNBT or COPPERHEDGE backdoors without any download…
South Korean agencies warned that a state-backed hacking group is actively targeting citizens and businesses using job-themed phishing emails and “watering hole” attacks on legitimate websites. The phishing lures include fake job applicants sending resume links and impersonated recruiters sending…
Researchers describe a real, ongoing Lazarus-linked campaign where targets are lured with attractive job offers and tricked into downloading a PDF viewer and “job description” documents. Opening the files installs backdoors and, in at least one wave, attackers used a Windows zero-day to gain deep…
This bulletin describes multiple real-world social engineering campaigns where attackers trick people into trusting a familiar screen, like a search result “install guide,” a recruiter outreach, or a helpdesk phone call. The lures push victims to paste commands, install fake software, or reset MFA,…
China-linked actor UTA0565 sent phishing emails that pushed recipients to click spoofed links to fake media/NGO websites. Visiting the sites triggered a Chrome-to-Windows zero-day exploit chain that escaped the browser sandbox and installed CLEANGULP malware for remote control.
Researchers reported four separate espionage groups using the same “BlueMoon” exploit kit within days, targeting organizations in the US and Southeast Asia. The attacks began with phishing emails that lured recipients to attacker-controlled websites, where Chrome and Windows vulnerabilities were…
