Iranian Cybercriminals Target Aerospace Workers via LinkedIn
ID: 11cbdb4f-f67a-53af-996c-a3480cc9e493
STIX ID: report--11cbdb4f-f67a-53af-996c-a3480cc9e493
Feed Name: Dark Reading
Threat Score
ClearSky reports an ongoing Iranian-linked phishing campaign (attributed to TA455 and Charming Kitten) targeting aerospace professionals on LinkedIn by impersonating recruiters; victims are lured to download a 'SIgnedConnection.zip' that contains an executable which side-loads a DLL (secure32.dll) to install Snail Resin/SlugResin backdoor, with C2 communications encoded on GitHub to evade detection.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.