Fake Cisco Job Posting Targets Korean Candidates
Summary: Cisco Talos reported a targeted campaign in which a Microsoft Word document named "Job Descriptions.doc," disguised as a Cisco Korea job posting and filled with content copied from legitimate online job listings, carried malicious macros that dropped a PE32 executable called "jusched.exe" into %APPDATA%\Roaming. The document's metadata indicates it may have been created in 2018 but was last saved on Jan. 29, 2019, and Talos linked it to related samples from August 2017 and November 2017 that used the same macros, the same XOR key of 0xe7, and the same API obfuscation.
What you should know: The command and control servers in all three campaigns were legitimate websites the attacker had compromised - www[.]secuvision[.]co[.]kr, www[.]syadplus[.]com, and ilovesvc[.]com - so blocking known-bad domains would not have stopped this, and the same actor has been running these tactics since at least 2017.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026