A new report from cybersecurity firm McAfee LLC today detailed a new global campaign that has targeted nuclear, defense, energy and financial companies across the globe.

Dubbed “Operation Sharpshooter,” the campaign has infiltrated dozens of companies, mostly in the U.S. and other English-speaking nations, with malicious software that extracts information from targeted systems.

The attack used a phishing campaign in which hackers pretended to be a recruiting firm sending what appeared to be legitimate emails to specific targets.

When those targets clicked on a malicious attachment, in this case a fake Microsoft Word document, the infiltration began by installing a second program called “Rising Sun.” That program is described as an implant that uses source code from the Lazarus Group’s 2015 backdoor Trojan Duuzer in a new framework to infiltrate the targeted network.

The Lazarus Group has been previously linked to North Korea, but the McAfee researchers do not point a finger in that direction.

“Operation Sharpshooter’s numerous technical links to the Lazarus Group seem too obvious to immediately draw the conclusion that they are responsible for the attacks, and instead indicate a potential for false flags,” the researchers noted. “Our research focuses on how this actor operates, the global impact and how to detect the attack. We shall leave attribution to the broader security community.”

Given that the intent of the campaign is to gather information, a state-sponsored campaign is likely.

“We know that this campaign was intended to conduct espionage – indeed, it was only recently launched,” explained Raj Samani, chief scientist at McAfee. “The question of the ultimate purpose remains to be seen.”

Samani added that in many cases, such attacks are a precursor for something else. “However, we are hopeful that identifying and sharing the details will prevent the true nature of the campaign from being carried out,” he said.

Photo: Program Executive Office Soldier/Wikimedia Commons