A global hacking operation is said to target governments, defense contractors, telecommunication companies, transportation, education, healthcare and others around the world.
Dubbed 'Operation Sharpshooter' by researchers at McAfee, the campaign appears to be the first stage of a cyber espionage campaign.
It has only been active for a few weeks, but has hit at least 87 organizations in 24 countries during October and November alone.
While organizations across the globe have been targeted by the campaign, including South America, Europe, the Middle East, India, Australia and Japan, among others, analysis by McAfee suggests that victims are predominantly in the U.S..
According to the researchers, the operation is meant for intelligence gathering efforts by foreign government(s).
The main focus for this 'Operation Sharpshooter', appears to be attacking defense and government departments, as well as businesses in the telecommunications industry, energy, nuclear and financial sectors.
Researchers note that the attacks display many of the hallmarks of the Lazarus Group, a hacking group working on behalf of North Korea. But the researchers didn't find good evidence to confirm it.
"Technical indicators solely being used to determine attribution are fraught with difficulty, subsequently we have to consider that this could well be an attack with false flags to point to the Lazarus group," explained Raj Samani, chief scientist at McAfee
The operation started in October 25th, with a series of phishing emails masquerading as recruitment emails. Sent to targets, the malicious Word documents share the same author name: Richard. They contain job descriptions for positions at various companies.
When opened, the documents downloads malicious macro and injects a downloader for the Sharpshooter malware into the memory of Word. With the targeted system compromised, the malware then serves as a downloader for the second stage of the campaign, called the 'Rising Sun'.
Rising Sun is a modular backdoor that performs reconnaissance attack on the targets' network.
This in turn provides attackers with access to machine-level information, making them able to collect data which include: computer name, IP address data, native system information, documents, usernames, network configuration, system settings and more.
The information gathered are then sent to a command and control server, controlled by the attacker.
The malware can also execute various commands, get additional files and is capable of clearing memory and deleting its activity. Designed purposely for espionage, this makes the malware capable of working in stealth.
"Operation Sharpshooter is yet another example of a sophisticated, targeted attack being used to gain intelligence for malicious actors," continued Samani.
"However, despite its sophistication, this campaign depends on a certain degree of social engineering which, with vigilance and communication from businesses, can be easily mitigated."
In March 2019, McAfee was able to link Sharpshooter attacks to North Korea, after the company was granted access to the server by government officials.
