|
Update on campaign targeting security researchers By Adam Weidemann, Google Threat Analysis Group April 1, 2021 In January, the Threat Analysis Group documented a hacking campaign, which we were able to attribute to a North Korean government-backed entity, targeting security researchers. On March 17th, the same actors behind those attacks set up a new website with associated social media profiles for a fake company called “SecuriElite.”
The new website
claims the company is an offensive security
company located in Turkey that offers pentests,
software security assessments and exploits. Like
previous websites we’ve seen set up by this
actor, this website has a link to their PGP
public key at the bottom of the page. In
January, targeted researchers
reported
that the PGP key hosted on the attacker’s blog
acted as the lure to visit the site where a
browser exploit was waiting to be triggered.
 SecuriElite website
The attacker’s
latest batch of social media profiles continue
the trend of posing as fellow security
researchers interested in exploitation and
offensive security. On LinkedIn, we identified
two accounts impersonating recruiters for
antivirus and security companies. We have
reported all identified social media profiles to
the platforms to allow them to take appropriate
action.
 Actor controlled LinkedIn profiles
 Actor controlled Twitter profiles
 Tweet from SecuriElite announcing new company At this time, we have not observed the new attacker website serve malicious content, but we have added it to Google Safebrowsing as a precaution.
Following our
January blog post,
security researchers successfully identified
these actors using an Internet Explorer 0-day.
Based on their activity, we continue to believe
that these actors are dangerous, and likely have
more 0-days. We encourage anyone who discovers a
Chrome vulnerability to report that activity
through the Chrome
Vulnerabilities Rewards Program
submission process.
Actor controlled sites and accountsFake Security Company Website:
LinkedIn Profiles:
Email:
Attacker Owned Domains:
|
Terms of Use | Copyright © 2002 - 2021 CONSTITUENTWORKS SM CORPORATION. All rights reserved. | Privacy Statement
