North Korea-linked APT group posed as Samsung recruiters is a spear-phishing campaign that targeted South Korean security companies that sell anti-malware solutions, Google TAG researchers reported.
According to the Google Threat Horizons report, the state-sponsored hackers sent fake job offers to employees at the security companies. Google TAG researchers reported that the same group, tracked as Zinc,” also targeted security researchers in past campaigns
The attackers used a malformed PDF claiming to be a job description for a role at Samsung, for this reason, the recipient was not able to open it and contacted the sender that in turn provided him with a link to a “Secure PDF Reader” app.
The app, which was stored in Google Drive, was a tainted version of the legitimate PDF reader PDFTron. Upon installing the app a backdoor is established on the victims’ devices.
