Beware: Your LinkedIn Inbox May Contain Malware

The current unstable economy has left quite a few people looking for a new job. A lot of those people are using LinkedIn to seek new job opportunities, but a group of bad actors is doing their best to make looking for a job a bad time.

A new, very elaborate malware campaign has been detected by security researchers working with eSentire. The malware used by the hackers is called "more_eggs" and is a fileless backdoor, distributed through believable phishing messages sent to victims' LinkedIn inboxes.

We previously covered the campaign and mentioned that what sets it apart is the great pains that the bad actors took to make their phishing lures look as believable as possible. The messages contain malicious archive files, usually zips, that are named exactly like the job specialization of the victim, but with the word "position" appended, as reported by eSentire in their full report that came out a day after the original announcement of the phishing campaign.

Once a LinkedIn user targeted by the campaign opens the fake job offer, they launch the silent install of the fileless backdoor more_eggs. The backdoor is a significant threat, as it allows the threat actors behind the campaign download additional malicious files on the victim's system and take control of the compromised system.

eSentire experts list the threat actors behind the malware as an entity called Golden Chickens and explain that the more_eggs malware is not operated by them only, but is rather sold as a service package to other hackers who want to use it. "Malware as a service" is not a new concept.

We have previously seen threat actors distributing ransomware and other types of malware as a service, either against upfront payment or against a cut of the profit made by the third-party hackers who deploy the malware.

More_eggs is a significant threat because it hijacks and uses Windows processes to deploy itself. Those legitimate processes are given functions to execute using scripts. Due to the low profile that the malware maintains on the victim's system, being fileless and abusing legitimate system processes, the malware has attracted the attention of notorious advanced persistent threat groups including Cobalt Group, FIN6 and Evilnum.

eSentire has published a number of threat indicators related to the more_eggs malware. Most notably, they listed the file hash of the malicious zip file and the download server used by the malware.

Server: ec2-13-58-146-177.us-east-2.compute.amazonaws[.]com

More_eggs zip file hash: 776c355a89d32157857113a49e516e74

The fact that large threat actors are showing interest in the more_eggs malware indicates that the highly targeted approach to phishing, sometimes called spear phishing, seems to be working out for the hackers.