Hackers Sneak ‘More_Eggs’ Malware Into Resumes Sent to Corporate Hiring Managers

A new set of phishing attacks delivering the
more_eggs malware has been observed striking
corporate hiring managers with bogus resumes as an infection
vector, a year after potential candidates looking for work on
LinkedIn were lured with weaponized job offers^[1].

“This year the more_eggs operation has flipped the social
engineering script, targeting hiring managers with fake resumes
instead of targeting jobseekers with fake job offers,” eSentire’s
research and reporting lead, Keegan Keplinger, said in a statement^[2].

The Canadian cybersecurity company said it identified and
disrupted four separate security incidents, three of which occurred
at the end of March. Targeted entities include a U.S.-based
aerospace company, an accounting business located in the U.K., a
law firm, and a staffing agency, both based out of Canada.

The malware, suspected to be the handiwork of a threat actor
called Golden Chickens (aka Venom
Spider^[3]), is a stealthy, modular
backdoor suite capable of stealing valuable information and
conducting lateral movement across the compromised network.

“More_eggs achieves execution by passing malicious code to
legitimate windows processes and letting those windows processes do
the work for them,” Keplinger said. The goal is to leverage the
resumes as a decoy to launch the malware and sidestep
detection.

The role reversal in the modus operandi aside, it’s unclear what
the attackers were after in light of the fact that the intrusions
were stopped before they could bring their plans to fruition. But
it’s worth pointing out that more_eggs, once deployed, could be
used as a jumping off point for further attacks such as information
theft and ransomware.

“The threat actors behind more_eggs use a scalable,
spear-phishing approach that weaponizes expected communications,
such as resumes, that match a hiring manager’s expectations or job
offers, targeting hopeful candidates that match their current or
past job titles,” Keplinger said.