Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Fake North Korean IT Worker Linked to Beaver Tail Video Conference App Phishing Attack

Summary: Unit 42 researchers identified a North Korean IT worker cluster tracked as CL-STA-0237 that ran phishing attacks using malware-infected video conference installers imitating MiroTalk and FreeConference, delivering BeaverTail malware at the start of job interviews. The cluster, which likely operates from Laos, exploited a U.S.-based SMB IT services company's information and accounts to apply for other jobs, and with moderate confidence secured a position at a major tech company in 2022 with access to its single sign-on system.

Bottom line: A cluster tied to North Korea's WMD and ballistic missile programs held SSO access inside a major tech company under a fake identity, and Unit 42 expects these job-related campaigns to persist and escalate despite law enforcement efforts.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Threat Actors & Nation-State
Related