Hackers Refine LinkedIn Scraped Data to Launch Targeted Attacks
Just a few days ago another massive LinkedIn user data dump posted on a hacking forum made headlines. Now the same data is being carefully organized and refined by threat actors to launch new, targeted attacks on LinkedIn users.
We covered the newest instance of LinkedIn user data being scraped by bad actors and being put up for sale on the dark web just a couple of days ago. The incident, while not representing a data leak or a security breach of LinkedIn per se, because the data was scraped using scripts from public-facing profiles, involved 700 million users' records being lumped together and put up for sale on underground hacking forums.
Now the hackers are making the most of the data they acquired. New reports state that a new, refined iteration of the data has been published on hacker forums. A user has collated a file containing 88 thousand profiles of LinkedIn users he calls "owners", implying business owners, who have changed their job position in the span of the past three months.
The records in the JSON database contain the emails, full names and other public details of the "owners" mentioned in the forum post.
The approach in this specific targeted data set seems to be to focus on people who are busy with enrolling lots of new staff, are potentially heavily encumbered with lots of emails and organizational duties and are also potentially more likely to click a phishing link in a malicious email.
LinkedIn has made it abundantly clear that the data sets posted on the underground forums do not represent a data breach, as all the information contained in the forum posts has been scraped from profiles that have been set as public. This is factually true - there has been no breach of security and LinkedIn users have not had any data flagged as private exposed in any way.
This still does not change the fact that scraping this data is against the LinkedIn terms of service and that the data, especially when narrowed down and refined in ways similar to this latest 88 thousand "owners" post, can be used for malicious purposes. The possibilities for creative and resourceful hackers are many. From raw credential stuffing, to phishing to impersonation, there is a lot of malicious activities that can be attempted using the data.
