APT37’s Pretexting-Based Targeted Intrusion: Analysis of Facebook Reconnaissance and Software Tampering Attacks
Introduction to Malware Binary Triage (IMBT) Course
Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.
Enroll Now and Save 10%: Coupon Code MWNEWS10
Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.
-3.png)
◈ Key Findings
- Conducted reconnaissance using two Facebook accounts claiming to be from Pyongyang and Pyongsong, North Korea
- Built trust by adding targets as Facebook friends, then moved the conversation to Messenger and lured them using specific topics
- Tricked targets into installing a dedicated PDF viewer under the pretense of sharing an encrypted PDF document on military weapons
- Executed shellcode and gained initial access through a carefully tampered Wondershare PDFelement installer
- Delivered follow-up commands through a JPG-disguised payload delivered via the Seoul branch website of a Japanese real estate information service
- Behavior-based EDR is required to detect the identified indicators of compromise (IoCs) and respond to APT evasion techniques
Article Link: APT37’s Pretexting-Based Targeted Intrusion: Analysis of Facebook Reconnaissance and Software Tampering Attacks
1 post - 1 participant
Malware Analysis, News and Indicators - Latest topics
Sp123
"An underestimated security threat to organizations is employee apathy and burn out."
