Iran-Linked Hackers Use Fake Job Recruiters to Target Aerospace Industry in Espionage Campaign

Day

–:–

Post Activated

An Iranian-linked hacker group has launched a sophisticated espionage campaign targeting the aerospace industry, using fake job recruiters on LinkedIn as a deceptive entry point, researchers have uncovered.

While such “fake worker” schemes are often associated with North Korean threat actors, the Israel-based cybersecurity firm ClearSky has attributed this campaign to TA455, a subgroup of the Iranian cyberwarfare group known as Charming Kitten. This marks a shift in tactics, with Iranian threat actors either emulating Pyongyang-backed hackers to mask their activities or possibly sharing tools and methods with North Korea.

The Attack Framework: Malicious Job Offers and Advanced Malware

Since at least September 2023, TA455 has used counterfeit recruiting websites and LinkedIn profiles to lure targets into downloading seemingly legitimate documents embedded with malicious software. These files delivered the SnailResin malware, which subsequently activated the SlugResin backdoor, enabling deep infiltration into victim systems.

Both malware strains have been previously attributed to Charming Kitten, also known as APT35, by Microsoft. Interestingly, these tools also bear similarities to malware used by North Korean state-sponsored groups like Lazarus and Kimsuky, creating potential overlap or deliberate misdirection between Iranian and North Korean campaigns.

Broader Targeting and Geopolitical Implications

Iranian hackers have a history of targeting critical industries such as aerospace, aviation, and defense across regions like Israel, the UAE, Turkey, India, and Albania. The ongoing campaign shows signs of evolution, with LinkedIn profiles linked to this operation resembling updated versions of those uncovered by Mandiant in earlier research.

While the Middle East remains the primary focus for Iranian cyber activity, ClearSky’s findings indicate an expansion into Eastern Europe, likely influenced by geopolitical tensions. The campaign aligns with Iran’s strategic aims, targeting entities perceived as threats to its alliances and interests.

Advanced Tactics for Evasion

The latest campaign by TA455 demonstrates enhanced strategies to bypass modern security measures:

Legitimate Infrastructure Exploitation: The hackers used traffic from platforms like Cloudflare, GitHub, and Microsoft Azure Cloud to conceal their operations and evade detection.
Trusted Platform Manipulation: Fake LinkedIn recruiter profiles associated with fabricated companies were employed to build trust with victims, increasing the likelihood of engagement with malicious links or attachments. This tactic bypasses traditional email or website-based security systems.
Adaptable Targeting Methods: By continuously updating their infrastructure and attack methods, TA455 is able to remain one step ahead of current cybersecurity defenses.

Collaborative Threat or Deceptive Masking?

Researchers speculate that Iran may have adopted North Korean methodologies to sow confusion about attribution or potentially collaborated with Pyongyang in a shared cyber offensive. The similarities between the two campaigns raise concerns about cross-nation sharing of advanced cyber tools among hostile actors.

Heightened Vigilance for High-Value Industries

This campaign serves as a reminder of the growing sophistication of state-sponsored cyber espionage. Industries like aerospace and defense must remain vigilant, particularly against trusted platforms being weaponized for malicious purposes.

By exploiting professional networks like LinkedIn and trusted infrastructure, attackers are shifting the threat landscape, making traditional cybersecurity measures insufficient. Strengthening employee awareness and deploying advanced detection systems are crucial to mitigating these evolving risks.