Full Report
FIN6, a financially motivated group tracked for years by cybersecurity researchers, is now lurking on sites such as LinkedIn and Indeed to spread malware, a new report says.
Analysis Summary
# Threat Actor: FIN6 (Skeleton Spider)
## Attribution & Identity
- **Threat Actor:** FIN6
- **Known Aliases:** Skeleton Spider
- **Associated Groups/Tools:** Utilizes the MoreEggs backdoor, which was developed by the threat actor tracked as Venom Spider and is sold as malware-as-a-service.
## Activity Summary
FIN6 is a long-running cybercriminal group active since at least 2015, historically known for stealing payment card data and breaching point-of-sale (PoS) systems. Their recent activity indicates a strategic shift toward broader enterprise threats, including ransomware operations. The latest described campaign involves using recruitment scams on platforms like LinkedIn and Indeed to target recruiters. They pose as job seekers to deliver malware via fake resumes/phishing emails.
## Tactics, Techniques & Procedures
- **Initial Compromise:** Social engineering via platforms (LinkedIn, Indeed) posing as job seekers initiating contact with recruiters.
- **Delivery:** Sending professionally written phishing emails that contain no clickable links, forcing recipients to manually type URLs to bypass security filters.
- **Infrastructure:** Hosting landing pages (mimicking resume portfolios) on trusted cloud infrastructure, specifically mentioning Amazon Web Services (AWS).
- **Evasion:** Employing traffic filtering and CAPTCHA on landing pages to prevent automated analysis tools from accessing the malware payload.
- **Execution:** Delivering a malicious ZIP file containing the MoreEggs backdoor.
- **Post-Exploitation:** Using the backdoor to access the targeted system, steal credentials, and carry out ransomware attacks.
- **Historical TTP:** Stealing and selling millions of payment card numbers on underground criminal marketplaces.
## Targeting
- **Sectors:** Historically focused on Hospitality and Retail (PoS systems). Current focus suggests broader enterprise targeting, particularly HR/Recruitment personnel.
- **Geography:** Not explicitly mentioned for the current campaign, but historical focus implies jurisdictions where retail/hospitality systems are prevalent.
- **Victims:** Recruiters working for organizations across various sectors.
## Tools & Infrastructure
- **Malware Families Used:** MoreEggs (backdoor).
- **Infrastructure:** Trusted cloud services, including Amazon Web Services (AWS), for hosting phishing landing pages.
- **C2/URLs:** The article details forcing victims to manually type a URL to access the malicious landing page, but specific destination domains/IPs are not provided (and thus cannot be defanged).
## Implications
FIN6 is evolving from purely high-volume financial theft (PoS data) to engaging in disruptive, high-impact enterprise operations (ransomware). Their adoption of sophisticated social engineering tactics, including leveraging cloud hosting, advanced evasion techniques (manual URL typing, CAPTCHA/traffic filtering), and purchasing legitimate malware-as-a-service tools (MoreEggs), indicates increased professionalism and lethality.
## Mitigations
- **Social Engineering Awareness:** Implement rigorous training for HR and recruitment staff regarding unsolicited contact, especially concerning job applications delivered via email or personal platforms like LinkedIn.
- **Email Security:** Configure email gateways to inspect links closely, even those not delivered via explicit HTML anchor tags, and warn users about links requiring them to manually type the URL.
- **Endpoint Defense:** Deploy advanced endpoint detection and response (EDR) solutions capable of detecting the MoreEggs backdoor execution.
- **Infrastructure Trust Verification:** Scrutinize suspicious resume/portfolio links, particularly those hosted on high-reputation cloud services (e.g., AWS) but linked from unsolicited communication.
- **Filter Verification:** Ensure security mechanisms can bypass or effectively analyze content behind traffic filters and CAPTCHA prompts if possible, or implement strict policies against downloading unknown attachments from non-verified sources.