Malware - Hackers Use Fake Resumes to Deploy Crypto Miner

What Happened

An alarming phishing campaign is currently underway, specifically targeting French-speaking corporate environments. Hackers are using fake resumes to deploy malware that not only steals credentials but also mines cryptocurrency. The campaign, dubbed FAUX#ELEVATE, utilizes highly obfuscated VBScript files disguised as CV documents, which are delivered via phishing emails. Once executed, these scripts unleash a multi-purpose toolkit designed for maximum monetization through credential theft and data exfiltration.

The malicious activity is notable for its clever use of legitimate services. The attackers host their payloads on platforms like Dropbox and utilize Moroccan WordPress sites for command-and-control operations. This approach allows them to bypass traditional security measures, making it harder for organizations to detect the attack.

Who's Being Targeted

The primary targets of this campaign are enterprise machines, particularly those that are domain-joined. The malware's design ensures that it only activates on corporate systems, effectively excluding standalone home computers. This selective targeting means that the attackers can extract valuable corporate credentials and resources, increasing the potential for financial gain.

As the attack unfolds, the dropper file displays a fake French-language error message, misleading users into believing the file is corrupted. This tactic is an effective way to encourage users to grant the malware administrative privileges, allowing it to disable security controls and operate undetected.

Signs of Infection

Once the malware gains administrative access, it initiates a series of destructive actions. It disables security features like Microsoft Defender, modifies Windows Registry settings to lower defenses, and deletes itself to erase any evidence of the attack. The dropper also fetches password-protected archives from Dropbox, containing tools for data theft and cryptocurrency mining.

Indicators of infection include unusual system behavior, such as unexpected CPU usage spikes due to the XMRig cryptocurrency miner being activated. Additionally, users may notice strange network activity as the malware communicates with its command-and-control servers.

How to Protect Yourself

To safeguard against this sophisticated attack, organizations should implement robust email filtering solutions that can detect and block phishing attempts. Regular employee training on recognizing phishing scams is also crucial.

Furthermore, maintaining up-to-date security patches and employing endpoint protection solutions can help mitigate risks. Organizations should also consider monitoring network traffic for unusual patterns that may indicate the presence of malware. By taking these proactive measures, companies can significantly reduce their vulnerability to such attacks.