CSIS entry 374 · February 2022
Researchers identified campaigns by two North Korean government-backed groups targeting employees across numerous media, fintech, and software companies. The hackers used phishing emails advertising fake job opportunities and exploited a vulnerability in Google Chrome to compromise the companies’ websites and spread malware.
On February 10, Threat Analysis Group discovered two distinct North Korean government-backed attacker groups exploiting a remote code execution vulnerability in Chrome, CVE-2022-0609. · 2022-02
On February 10, Threat Analysis Group discovered two distinct North Korean government-backed attacker groups exploiting a remote code execution vulnerability in Chrome, CVE-2022-0609.
https://blog.google/threat-analysis-group/countering-threats-north-korea/
Targeting of American news media and IT companies · Mar 2022
The Lazarus Group used a Google Chrome zero-day to target employees at American news media and IT companies. The Lazarus Group used phishing emails impersonating recruiters at Disney, Google, and Oracle with fake job opportunities, which included malicious links to spoofed Indeed and ZipRecruiter websites. An exploit kit hidden within the websites fingerprinted the target system and collected available client information.
250 individuals working for 10 different news media, domain registrars, web hosting providers and software vendors · 24/03/2022
Researchers from Google's Threat Analysis Group reveal the details of a campaign consistent with Operation Dream Job, exploiting the Google Chrome CVE-2022-0609 vulnerability one month before it was patched. [Date Occurred: Since at least 04/01/2022; Date Discovered: 10/02/2022]
Operation Dream Job exploiting Chrome CVE-2022-0609 · 2022-03-24T16:00:00+00:00 (datePublished)
On February 10, Threat Analysis Group discovered two distinct North Korean government-backed attacker groups exploiting a remote code execution vulnerability in Chrome, CVE-2022-0609. ... The campaign, consistent with Operation Dream Job, targeted over 250 individuals working for 10 different news media, domain registrars, web hosting providers and software vendors.
country: U.S. (U.S. based organizations)
U.S. based organizations spanning news media, IT, cryptocurrency and fintech industries
actors: Operation Dream Job and Operation AppleJeus (two North Korean government-backed groups)
These groups' activity has been publicly tracked as Operation Dream Job ... Another North Korean group, whose activity has been publicly tracked as Operation AppleJeus, targeted over 85 users in cryptocurrency and fintech industries.