A new report from ESET has found that most nation-state threat actors rely on spear phishing as a primary initial access technique.
In the second and third quarters of 2024, state-sponsored APTs from China, Russia, Iran, and North Korea used social engineering attacks to compromise their targets.
Iranian threat actors continued conducting cyber espionage against countries across the Middle East, Europe, and the US. They also expanded their targeting to hit financial companies in Africa.
“We observed indications that Iran-aligned groups might be leveraging their cyber capabilities to support diplomatic espionage and, potentially, kinetic operations,” ESET says.
“These groups compromised several financial services firms in Africa – a continent geopolitically important to Iran; conducted cyber espionage against Iraq and Azerbaijan, neighboring countries with which Iran has complex relationships; and increased their interest in the transportation sector in Israel. Despite this seemingly narrow geographical targeting, Iran-aligned groups maintained a global focus, also pursuing diplomatic envoys in France and educational organizations in the United States.”
The Russian threat actor Sednit (also known as “APT28” or “Fancy Bear”) launched phishing attacks designed to compromise Roundcube servers in a variety of sectors.
“We discovered new Sednit spear phishing waves, which are part of the already known Operation RoundPress campaign directed against Roundcube webmail servers,” the researchers write.
“In the past several months, we observed such spear phishing waves against governmental, academic, and defense-related entities in Cameroon, Cyprus, Ecuador, Indonesia, Romania, and Ukraine. Sednit used a wide range of lures, from legitimate news articles to a commercial brochure for thermal optics.”
The researchers note that North Korean threat actors often establish trust with their victims using phony employment offers before tricking them into installing malware.
“Another distinctive feature of many attacks that we attribute to North Korea-aligned groups is the gradual building up of the relationship with the victim,” ESET says. “Both Lazarus and Kimsuky used fake job offers to approach the targeted individuals. Only after the victim responds and a relationship is established, is a malicious package sent to the victim.”
KnowBe4 empowers your workforce to make smarter security decisions every day. Over 70,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.
ESET has the story.
