FIN6 Hackers Mimic as Job Seekers to Attack Recruiters with Weaponized Resumes

A sophisticated cybercrime campaign has emerged where threat actors are exploiting the trust inherent in professional recruitment processes, transforming routine job applications into sophisticated malware delivery mechanisms. The FIN6 cybercrime group, also known as Skeleton Spider, has developed an elaborate social engineering scheme that begins with legitimate-seeming interactions on professional platforms like LinkedIn and Indeed, […] The post FIN6 Hackers Mimic as Job Seekers to Attack Recruiters with Weaponized Resumes appeared first on Cyber Security News.

Jun 12, 2025 - 08:10

FIN6 Hackers Mimic as Job Seekers to Attack Recruiters with Weaponized Resumes

A sophisticated cybercrime campaign has emerged where threat actors are exploiting the trust inherent in professional recruitment processes, transforming routine job applications into sophisticated malware delivery mechanisms.

The FIN6 cybercrime group, also known as Skeleton Spider, has developed an elaborate social engineering scheme that begins with legitimate-seeming interactions on professional platforms like LinkedIn and Indeed, where attackers pose as enthusiastic job seekers engaging with recruiters before following up with carefully crafted phishing messages containing malicious resume attachments.

This financially motivated cybercrime organization has significantly evolved from its origins in point-of-sale breaches and payment card theft operations, now focusing on broader enterprise threats including ransomware deployment through socially engineered campaigns.

The group’s current methodology demonstrates a sophisticated understanding of human psychology and trust dynamics within professional environments, leveraging the natural inclination of recruiters to review potential candidate materials as an entry vector for malware deployment.

DomainTools researchers identified that FIN6’s phishing campaigns utilize professionally worded messages from fake applicants, employing non-clickable URLs to bypass automated link detection systems.

These communications contain domains that follow predictable patterns, combining first and last names such as bobbyweisman[.]com and ryanberardi[.]com, all registered anonymously through GoDaddy’s domain privacy services to complicate threat attribution and takedown efforts.

The attackers exploit GoDaddy’s built-in privacy features to shield true registrant details from public view, using disposable email addresses, anonymous IP addresses, and prepaid payment methods to maintain their infrastructure just long enough to execute active campaigns.

The malware payload of choice in these operations is more_eggs, a stealthy JavaScript-based backdoor developed by the Venom Spider group as malware-as-a-service, facilitating credential theft, system access, and follow-on attacks including ransomware deployment.

This modular backdoor operates primarily in memory to evade detection while providing comprehensive command execution capabilities and serving as a platform for delivering additional malicious payloads to compromised systems.

Cloud Infrastructure and Evasion Mechanisms

FIN6’s technical sophistication becomes particularly evident in their abuse of trusted cloud infrastructure, specifically Amazon Web Services, to host their malicious operations while avoiding detection.

The group establishes landing pages on cloud-hosted domains that closely resemble legitimate personal resume portfolios, typically mapping these domains to AWS EC2 instances or S3-hosted static sites that become virtually indistinguishable from authentic personal or business hosting environments.

The attack infrastructure incorporates sophisticated traffic filtering logic designed to distinguish between legitimate victims and security analysis tools through multiple layers of environmental fingerprinting.

The system performs IP reputation and geolocation checks, restricting access to residential ISP ranges while blocking connections from cloud infrastructure, VPN services, or known threat intelligence networks.

Additionally, the platform conducts operating system and browser fingerprinting, specifically checking for Windows browser user-agent strings such as Mozilla/5.0 (Windows NT 10.0; Win64; x64) while blocking or redirecting visitors using Linux, macOS, or uncommon browsers.

When victims successfully navigate these filtering mechanisms, they encounter CAPTCHA verification techniques that serve as final gates ensuring human presence before payload delivery.

The malware delivery chain utilizes ZIP files containing disguised .LNK Windows shortcut files that execute hidden JavaScript using wscript.exe, ultimately connecting to external resources to download the more_eggs backdoor.

The persistence mechanisms include registry run keys at HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ and command-and-control communication via HTTPS with spoofed User-Agent headers, often executing PowerShell commands using the syntax: powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -EncodedCommand.

Speed up and enrich threat investigations with Threat Intelligence Lookup! -> 50 trial search requests

The post FIN6 Hackers Mimic as Job Seekers to Attack Recruiters with Weaponized Resumes appeared first on Cyber Security News.