Халдлага үйлдэгчид Google Docs платформыг ашиглан кибер аюулгүй байдлын мэргэжилтнүүдэд хортой програм суулгахыг завдсан байна.
Black Hat болон Def Con бага хурлын үеэр хакерууд X нийгмийн сүлжээгээр дамжуулан кибер аюулгүй байдлын мэргэжилтнүүдтэй холбогдож, нэр хүндтэй крипто мэдээллийн сайтын ажилтан гэх нэрээр хуурамч бага хуралд урьжээ. Huntress аюулгүй байдлын компанийн мэдээлснээр, хакерууд Google App Script ашиглан жинхэнэ мэт харагдах Google Docs баримт бичгийг боловсруулж, уг баримтыг шифрлэгдсэн гэж итгүүлэн хуурамч түлхүүр оруулахыг шаардсан байна.
Энэхүү залилангийн зорилго нь хэрэглэгчийн үйлдлийн системээс хамааран macOS болон Windows үйлдлийн системд зориулсан хортой програмуудыг суулгах явдал байжээ. Тодруулбал, Apple компьютерт зориулсан мэдээлэл хулгайлах програм, Windows-д зориулсан алсын зайнаас удирдах хэрэгсэл, мөн Ledger крипто түрийвчний хуурамч суулгагчийг ашиглан халдлага үйлдэхийг завдсан байна.
Аюулгүй байдлын салбарын мэргэжилтнүүд рүү чиглэсэн ийм төрлийн халдлага өмнө нь гарч байсан ч энэ удаагийн тохиолдолд Google-ийн албан ёсны хэрэгслийг ашигласан нь илүү үнэмшилтэй болгосон байна. Huntress компанийн судлаачид халдлагын арга барилыг илрүүлэхийн тулд хакеруудтай харилцаж, нөхцөл байдлыг судалсан байна.
Дэлгэрэнгүйг эх сурвалжаас харах
↓Эх сурвалжийг нээх ↓
If you are a malicious hacker, cybersecurity professionals may very well be the worst people in the world to try to hack, as there is a very good chance they are going to catch you.
A person pretending to work for a leading crypto news site targeted several cybersecurity professionals around the time of the Black Hat and Def Con hacking conferences earlier this month. The hacker approached attendees on the social media site X, both via public replies and DMs, and then leveraged Google Docs in an attempt to trick the targets into installing malware, according to researchers.
On Wednesday, security firm Huntress published a blog post detailing the hacking campaign, which targeted one of its researchers, who pretended to go along with it to learn what the hacker was trying to do.
In broken English, the hacker asked the researcher if they had plans to attend a conference next, and then mentioned a conference allegedly organized by the crypto news website, according to a screenshot of the conversation.
After that, the hacker shared a legitimate Google Doc that looked like it was a planning document for the fake conference. The document displayed a sidebar designed to make the target think it was encrypted. The goal was to first trick the target into entering a fake decryption key provided by the hacker. That was the first step in a process that would lead to the installation of malware for macOS and Windows, depending on the operating system used by the target, according to Huntress.
To make the sidebar appear real, the hacker used Google App Script, a platform that allows developers to customize the user interface of Google Docs with menus and sidebars, for example.
The hacker tried to trick Huntress’ researcher into installing an infostealer for Apple computers; a remote desktop viewing tool repurposed as malware for Windows; and a fake installer for the cryptocurrency wallet Ledger.
The person behind the account identified by Huntress researchers as the hacker did not respond when TechCrunch sent them a private message on X.
Hackers of all kinds — whether they are unknown government hackers using advanced spyware or North Korean government hackers using fake Twitter profiles — have targeted cybersecurity professionals before. What made this campaign a bit more believable was the use of a legitimate Google Doc and Google feature.
Google did not immediately respond when TechCrunch reached out asking if the company had seen this or similar hacking campaigns.
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.
