Iranian Cyber Espionage Comedy: MURKYTOUR Job Scam Hits Israel!
Iran-nexus threat actor UNC2428 is playing a cyber trick-or-treat, distributing MURKYTOUR backdoor malware under the guise of job offers in Israel. With a faux recruitment facade and a tool called RafaelConnect.exe, this social engineering campaign cleverly lures victims into giving up personal information while sneakily delivering malware.
Hot Take:
Looks like UNC2428 just secured the “Most Annoying Job Recruiter” award for 2024, with their cunning plan of turning a job application into a malware buffet. If only their dedication to cyber espionage was matched by an equally impressive dedication to actual job creation. Guess some people just don’t know how to work a 9-to-5!
Key Points:
- UNC2428 is delivering the MURKYTOUR backdoor through a job-themed social engineering campaign in Israel.
- The malware is disguised as a job application tool from a fake Rafael website.
- The campaign overlaps with activities attributed to Iran-linked group Black Shadow.
- UNC2428 is one of several Iranian threat clusters targeting Israel in 2024.
- Mandiant identified over 20 proprietary malware families used by Iranian actors this year.
Already a member? Log in here