Operation (노스 스타) North Star A Job Offer That’s Too Good to be True?
ID: bbde5527-5668-5ab2-bc6a-1c3288411aaa
STIX ID: report--bbde5527-5668-5ab2-bc6a-1c3288411aaa
Feed Name: McAfee Labs Blog
Threat Score
McAfee ATR documents a targeted 2020 campaign using falsified job-posting Word documents and remote template injection to deliver double-base64 encoded DLL implants (patched SQLite DLLs) that profile victims in the aerospace/defense and Korean political sectors; the activity shares TTPs and code similarities with 2017/2019 campaigns attributed to Hidden Cobra, includes numerous IoCs (file hashes and URLs), and offers mitigation guidance.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.