Thursday, February 27, 2025
HomeCyber AttackNew Research Reveals APT Groups Targeting Security Researchers

New Research Reveals APT Groups Targeting Security Researchers

Published on

SIEM as a Service

Follow Us on Google News

As per the research conducted by SentinelOne, a new risk has been identified, which affects the information security researchers as well as the infosec community.

Threat actors targeting the infosec community was not something new, as there were several instances where infosec individuals were targeted.

Many security researchers rely on security research tools like Ghidra, IDA Pro, and others to research various other exploits and develop Proof-of-Concepts. 

Those security researchers have been targeted in a spear-phishing campaign recently reported by Google Threat Analytics Group (TAG) in 2022.

Attacks on Security Researchers

As many security researchers could not afford security tool costs, they rely on torrents for pirated software, providing the same functionality as a paid tool for free.

Such tools were targeted by threat actors and leveraged for data exfiltration and post-exploitation techniques.

One such research from ESET in 2021 stated that some malicious actors targeted the IDA Pro torrents and injected a malicious code that downloads an additional DLL from a server in the name of IDA helper for following on post-exploitation.

Another report from Leiden University stated that around 10% of the proof-of-concept GitHub repositories have the capability to exfiltrate data from the targeted environment.

Many of the GitHub projects by Security researchers had established contact with malicious accounts.

SentinelOne also mentioned that “The ability to use a given reverse engineering or digital forensics tool to achieve living off the land types of attacks can be found.“ and “software such as Ghidra enables a threat actor to target members of the security community.”

Identifying Living off the Land

Living off the Land is an attack scenario in which threat actors use fileless malware and rely on legitimate software and services on the victim’s system for further attack cases. One such case study was conducted with the software Ghidra (released by the NSA).

An attacker can modify a .java jar file in Ghidra’s repository which contains the same class name as Ghidra within the /.Ghidra/patch directory to override the functionality.

This path releases the necessary security adversary for the security researchers, which is now under the threat actor’s control.

Once this control is gained, the threat actor can drop the stage-two payload on the system since that is the default functionality of Ghidra.

If a directory named /.ghidra does not exist during the first time installation of Ghidra, it will show a user-agreement policy that the threat actor can exploit to conduct a phishing campaign. 

Ghidra Attack Scenario (Source: SentinelOne)

A complete report on this research has been published by SentinelOne, including a case study, exploitation, and Protection against these kinds of attack scenarios.

Eswar
Eswar
Eswar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Latest articles

GitLab Vulnerabilities Allow Attackers to Bypass Security and Run Arbitrary Scripts

GitLab has urgently released security updates to address multiple high-severity vulnerabilities in its platform...

LibreOffice Flaws Allow Attackers to Run Malicious Files on Windows

A high-severity security vulnerability (CVE-2025-0514) in LibreOffice, the widely used open-source office suite, has...

Cisco Nexus Switch Vulnerability Allows Attackers to Cause DoS

Cisco Systems has disclosed a high-severity vulnerability (CVE-2025-20111) in its Nexus 3000 and 9000...

Silver Fox APT Hackers Target Healthcare Services to Steal Sensitive Data

A sophisticated cyber campaign orchestrated by the Chinese Advanced Persistent Threat (APT) group, Silver...

Supply Chain Attack Prevention

Free Webinar - Supply Chain Attack Prevention

Recent attacks like Polyfill[.]io show how compromised third-party components become backdoors for hackers. PCI DSS 4.0’s Requirement 6.4.3 mandates stricter browser script controls, while Requirement 12.8 focuses on securing third-party providers.

Join Vivekanand Gopalan (VP of Products – Indusface) and Phani Deepak Akella (VP of Marketing – Indusface) as they break down these compliance requirements and share strategies to protect your applications from supply chain attacks.

Discussion points

Meeting PCI DSS 4.0 mandates.
Blocking malicious components and unauthorized JavaScript execution.
PIdentifying attack surfaces from third-party dependencies.
Preventing man-in-the-browser attacks with proactive monitoring.

More like this

GitLab Vulnerabilities Allow Attackers to Bypass Security and Run Arbitrary Scripts

GitLab has urgently released security updates to address multiple high-severity vulnerabilities in its platform...

LibreOffice Flaws Allow Attackers to Run Malicious Files on Windows

A high-severity security vulnerability (CVE-2025-0514) in LibreOffice, the widely used open-source office suite, has...

Cisco Nexus Switch Vulnerability Allows Attackers to Cause DoS

Cisco Systems has disclosed a high-severity vulnerability (CVE-2025-20111) in its Nexus 3000 and 9000...