North Korean Hackers Launch and Run Fake Cybersecurity Website Called SecuriElite

 Cybercriminals just keep upping the ante to find new and interesting ways to dupe the public and infect computers and devices with malware. More recently, threat assessors with Google have discovered a fake cybersecurity website that hackers are using to trap victims.

What is the Deal?

On Wednesday, Google’s Threat Analysis Group reported that they uncovered a North Korean government-backed hacker group using a fake cybersecurity website to use with social engineering tactics to infect visitors with malware or steal information.

These threat actors created a fake company called SecuriElite with a website claiming they perform pentests, assessments, and exploits. The group also set up numerous social media accounts on Twitter and LinkedIn to lure threat researchers into visiting the fake website, which executes malicious code. The company says it’s from Turkey, and the site went live on March 17.

Fifteen social media accounts have been flagged as being associated with this fictitious company. Some profiles claim to be security researchers, and others, human resource professionals. One or two even claimed to be from Trend Micro to add legitimacy to the ruse. Since being identified as fraudulent, all the accounts are now suspended.

Google’s Threat Analysis Group originally discovered the social media accounts linked to a fake research blog with various profiles set up on Twitter, LinkedIn, Telegram, Discord, and Keybase back in January. According to The Hacker News “in a bid to communicate with the researchers and build trust, only to deploy a Windows backdoor that came in the form of a trojanized Visual Studio Project.”

What is Being Done About It?

As a follow-up, South Korean researchers from ENKI discovered a linked zero-day flaw in Internet Explorer that “allowed the hackers to access the devices managed by its security team with malicious MHTML files.” Microsoft has since patched the new bug.

Additionally, Google has flagged the malicious website by adding it to its Safebrowsing blocklist service so that unsuspecting users won’t visit it and become a victim. Although threat assessors claim it executes a browser exploit, the site itself has not been found to contain any drive-by downloads.

Since this threat was discovered so quickly, North Korean hackers will move on quickly and open up shop somewhere else.

According to The Hacker News, threat assessors theorize the motives behind this gig may be to attempt “to stealthily gain a foothold on systems in order to get hold of zero-day research, and in the process, use those unpatched vulnerabilities to stage further attacks on vulnerable targets of their choice.”

How Can Security Researchers Stay Safe?

Threat researchers keep the rest of us safe by looking for exploits and examining how they work to expose them and shut them down. However, these security professionals are even more at risk when deep down in the weeds searching for these vulnerabilities and nefarious capers.

Some tips to stay safe are:

• Never click links in social media accounts if you don’t know exactly who they belong to.
• Do not visit websites without thoroughly researching the company and vetting who they say they are.
• Turn on two-factor authentication on all your devices and accounts.
• Always use strong passwords on all your accounts and do not reuse them on multiple accounts.
• Perform security tests using a clean machine with no personal data or anything that could be jeopardized.
• Stay abreast of all software and hardware vulnerabilities and keep your systems updated with the latest security patches.
• Protect yourself with the best antivirus/anti-malware tools you can.
• Do not click on links in email or download any attachments unless you know you may download malicious software or visit fake websites.