Source: Iain Masterton via Alamy Stock Photo

A phishing campaign, active since last September, is targeting users on LinkedIn and other platforms by impersonating job recruiters in the aerospace industry.

ClearSky attributed the campaign to Iranian-linked threat actor TA455, which uses a spear-phishing approach to target and lure individuals. Once connected with its victims, the threat actors encourage them to download a zip file called "SIgnedConnection.zip."

Along with this, the threat actors also provide a PDF guide to their victims to instruct them on how to safely download and open the zip files.

The zip file contains an executable file that loads the malware onto the victim's device through DLL side-loading. A DLL file called "secure32[.]dll" is loaded onto their system, allowing the attacker access to run an undetected code.

Once this is done, the malware initiates an infection chain, which ultimately deploys Snail Resin malware, opening a backdoor titled "SlugResin." This malware and backdoor are both attributed to Charming Kitten, another Iranian threat actor, according to researchers at ClearSky.

The group uses several methods to evade detection, including encoding command-and-control (C2) communications on GitHub to make it more difficult for traditional detection tools to recognize that it's a threat, and it mimics tactics associated with Lazarus Group, causing complications in attribution.