PuTTY, KiTTY and Sumatra PDF Reader – I did my due diligence before installing these – and now they have been targeted by ZINC, a state-sponsored group operating out of North Korea.
ZINC weaponizing open-source software – Microsoft Security Blog
Before writing this blog post I had checked my system and software, even though I do not think I have been involved in any suspicious activity on LinkedIn, and all seems OK. Open-source software has its security risks – better to be safe than sorry.
ZINC primarily targeted engineers and technical support professionals working at media and information technology companies located in the UK, India, and the US. Targets received outreach tailored to their profession or background and were encouraged to apply for an open position at one of several legitimate companies.
Microsoft Security Threat Intelligence
LinkedIn, that is how this threat actor starts this particular campaign, by posing as recruiters, building relationships and trust with their victims via Microsoft’s LinkedIn platform. LinkedIn, a social media platform, full of prime targets, listing their roles and the systems they are responsible for – many of them looking for work, both for themselves and their organisations. It has to be worth a LinkedIn membership to the threat actors to join the platform and get full access to this platform, information and the trusted communications channels!
From there the threat actors got their victims to move onto WhatsApp and from there they delivered their malicious packages.
The Microsoft Threat Intelligence Center (MSTIC) has been monitoring the activity of ZINC, since June 2022, and has seen the use of ZetaNile malware, which steals information and facilitates the installation of further malware.
Actions to take
In their blog post Microsoft has listed a number of actions to meet these types of cyber-attacks – you should check them out, but here are some of the highlights:
- Use multi-factor authentication
- Educate your team in the methods threat actors use, such as spear phishing and social engineering attacks.
Clive Catton MSc (Cyber Security) – by-line and other articles
Further Reading
