Thursday, May 8, 2025
HomeCyber AttackNew Research Reveals APT Groups Targeting Security Researchers

New Research Reveals APT Groups Targeting Security Researchers

Published on

SIEM as a Service

Follow Us on Google News

As per the research conducted by SentinelOne, a new risk has been identified, which affects the information security researchers as well as the infosec community.

Threat actors targeting the infosec community was not something new, as there were several instances where infosec individuals were targeted.

Many security researchers rely on security research tools like Ghidra, IDA Pro, and others to research various other exploits and develop Proof-of-Concepts. 

- Advertisement - Google News

Those security researchers have been targeted in a spear-phishing campaign recently reported by Google Threat Analytics Group (TAG) in 2022.

Attacks on Security Researchers

As many security researchers could not afford security tool costs, they rely on torrents for pirated software, providing the same functionality as a paid tool for free.

Such tools were targeted by threat actors and leveraged for data exfiltration and post-exploitation techniques.

One such research from ESET in 2021 stated that some malicious actors targeted the IDA Pro torrents and injected a malicious code that downloads an additional DLL from a server in the name of IDA helper for following on post-exploitation.

Another report from Leiden University stated that around 10% of the proof-of-concept GitHub repositories have the capability to exfiltrate data from the targeted environment.

Many of the GitHub projects by Security researchers had established contact with malicious accounts.

SentinelOne also mentioned that “The ability to use a given reverse engineering or digital forensics tool to achieve living off the land types of attacks can be found.“ and “software such as Ghidra enables a threat actor to target members of the security community.”

Identifying Living off the Land

Living off the Land is an attack scenario in which threat actors use fileless malware and rely on legitimate software and services on the victim’s system for further attack cases. One such case study was conducted with the software Ghidra (released by the NSA).

An attacker can modify a .java jar file in Ghidra’s repository which contains the same class name as Ghidra within the /.Ghidra/patch directory to override the functionality.

This path releases the necessary security adversary for the security researchers, which is now under the threat actor’s control.

Once this control is gained, the threat actor can drop the stage-two payload on the system since that is the default functionality of Ghidra.

If a directory named /.ghidra does not exist during the first time installation of Ghidra, it will show a user-agreement policy that the threat actor can exploit to conduct a phishing campaign. 

Ghidra Attack Scenario (Source: SentinelOne)

A complete report on this research has been published by SentinelOne, including a case study, exploitation, and Protection against these kinds of attack scenarios.

Eswar
Eswar
Eswar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Latest articles

Top Ransomware Groups Target Financial Sector, 406 Incidents Revealed

Flashpoint analysts have reported that between April 2024 and April 2025, the financial sector...

Agenda Ransomware Group Enhances Tactics with SmokeLoader and NETXLOADER

The Agenda ransomware group, also known as Qilin, has been reported to intensify its...

SpyCloud Analysis Reveals 94% of Fortune 50 Companies Have Employee Data Exposed in Phishing Attacks

SpyCloud, the leading identity threat protection company, today released an analysis of nearly 6...

PoC Tool Released to Detect Servers Affected by Critical Apache Parquet Vulnerability

F5 Labs has released a new proof-of-concept (PoC) tool designed to help organizations detect...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Top Ransomware Groups Target Financial Sector, 406 Incidents Revealed

Flashpoint analysts have reported that between April 2024 and April 2025, the financial sector...

Agenda Ransomware Group Enhances Tactics with SmokeLoader and NETXLOADER

The Agenda ransomware group, also known as Qilin, has been reported to intensify its...

PoC Tool Released to Detect Servers Affected by Critical Apache Parquet Vulnerability

F5 Labs has released a new proof-of-concept (PoC) tool designed to help organizations detect...