Attackers use LinkedIn messages to plant remote access trojans

Researchers at ReliaQuest have identified a new phishing campaign on LinkedIn where people in senior roles are tricked into downloading malicious files. The attackers first strike up a conversation with the target, then send a WinRAR self-extracting archive with a believable file name. The archive contains a legitimate PDF reader, a malicious DLL, a portable Python interpreter and a decoy RAR file. Using DLL sideloading, the legitimate PDF reader loads the malicious DLL placed alongside it. Because it looks like a trusted application, it slips past many security tools. The code then uses the Python interpreter and an open-source Python script to install a remote access trojan, giving the attackers access and the ability to steal data.

What this means for your organisation

The attack bypasses your email filter because it never touches email. It also targets the group with the broadest access and the least time to hesitate: executives and key staff who receive LinkedIn approaches every week. With a legitimate PDF reader doing the dirty work, signature-based controls will not catch it. This is therefore as much a question of how leadership handles approaches as of technical detection.

Berigo recommends

• Give executives and key staff specific training on this technique, with LinkedIn named as the channel.
• Block or quarantine self-extracting archives and executables launched from download folders on corporate machines.
• Set up detection for DLL sideloading and unexpected execution of Python interpreters from user directories.
• Make it easy to report suspicious approaches on social media, not just in email.

Source

• hackread.com