Fake job offers, news sites used in suspected North Korean malware campaign

South Korean authorities on Thursday warned of an ongoing cyber campaign believed to be linked to North Korean hackers who are spreading malware through fake job offers and compromised websites, which can easily put both individuals and businesses at risk.

A joint task force comprised of the National Intelligence Service, the Korean National Police Agency and the Korea Internet & Security Agency issued the advisory after identifying a series of malware attacks by a state-backed hacking group. Cybersecurity experts believe the attacks detected during the first half of the year were likely carried out by Lazarus, a notorious North Korean hacking group.

The advisory identified two primary attack methods.

One tactic involves sending phishing emails designed to catch recipients' attention and lure them into clicking malicious links. The links lead to websites, such as blogs and GitHub pages, that have already been compromised by the attackers. Simply visiting those sites can result in a malware infection.

In one case, attackers hijacked the account of a legitimate headhunter and sent fake recruitment emails advertising high-paying jobs. Victims became infected with malware after opening an attached file.

The second method is known as a "watering hole" attack. Hackers first compromise frequently visited websites, such as news outlets or hospital websites, and then plant malicious code. Users can become infected simply by visiting one of the compromised sites.

"Recent watering hole attacks have become more sophisticated,” the task force said. “Attackers directly modify website source code and conceal malicious code, which makes detection through conventional security monitoring more difficult."

Malware infections can result in the theft of account credentials, passwords, personal information and files. The malware can also spread to other computers on the same network or enable attackers to extort victims by demanding ransom payments.

The task force urged individuals to keep all devices’ software up to date and avoid opening attachments or clicking links in emails from unknown senders.

It also advised organizations and security administrators to strengthen threat detection, provide regular cybersecurity training for employees and immediately report suspected cyber incidents to the relevant authorities and law enforcement agencies.

BY IM SOUNG-BIN [[email protected]]