ESET researchers have discovered a new Lazarus Operation DreamJob campaign targeting Linux users. ESET Research was able to reconstruct the full chain, from the ZIP file that delivers a fake HSBC job offer as a decoy up until the final payload: the SimplexTea Linux backdoor distributed through an OpenDrive cloud storage account.
ESET Research has released an in-depth blogpost offering an in-depth look into the abuse of vulnerable kernel drivers. Vulnerabilities in signed drivers are mostly utilized by game cheat developers to circumvent anti-cheat mechanisms,
ESET teamed up with Avast to research a constantly evolving remote access tool (RAT) with the usual backdoor functionality that ESET has dubbed Mikroceen only to discover that it is being used in espionage attacks against government and business entities (from the telcos and gas industries) in Central Asia.
