FIN6 Skeleton Spider Campaign Targeting HR Professionals via Fake Job Applications

**FIN6 Exploits Cloud Infrastructure in Sophisticated HR-Targeted Phishing Campaign** The financially motivated cybercrime group **FIN6** (also known as *Skeleton Spider*) is leveraging **fake job applications** and **trusted cloud services** to target human resources (HR) professionals in a highly evasive social engineering campaign. Researchers at **DomainTools** uncovered the operation, which combines **professional networking platforms** like LinkedIn and Indeed with **malware-hosted cloud infrastructure** to bypass traditional security defenses. ### **How the Attack Works** 1. **Initial Contact** – Attackers pose as job seekers on professional platforms, engaging recruiters to build rapport before sending phishing emails with malicious links. 2. **Fake Resume Sites** – Domains mimicking real applicant names (e.g., *bobbyweisman[.]com*, *ryanberardi[.]com*) are registered via **GoDaddy’s anonymous services** and hosted on **AWS EC2 or S3**, blending into legitimate cloud traffic. 3. **Sophisticated Evasion** – The sites employ **traffic filtering** to distinguish targets from security researchers, checking **IP reputation, geolocation, OS, and browser fingerprints**. Only residential Windows users bypass CAPTCHA walls to receive **malicious ZIP files** containing the **More_eggs backdoor**. 4. **Malware Deployment** – **More_eggs**, a modular JavaScript backdoor, operates in memory to evade detection, enabling **credential theft, command execution, and follow-on attacks**, including ransomware deployment. ### **Why HR is a Prime Target** HR teams frequently interact with external contacts and handle unsolicited communications, making them vulnerable to **social engineering**. The campaign exploits this trust, using **realistic job lures** to bypass email filters and endpoint security. FIN6’s shift from **point-of-sale (POS) breaches** to **enterprise ransomware** underscores its evolution toward higher-value targets. ### **Cloud Abuse & Detection Challenges** Attackers favor **AWS and other cloud platforms** due to: - **Low-cost setup** (free-tier abuse or compromised billing accounts). - **Trusted IP ranges** that evade enterprise network filters. - **Scalability** for hosting malicious infrastructure. The campaign highlights gaps in **perimeter-based security**, as traditional defenses struggle to detect threats embedded in **legitimate cloud services**. Security teams are advised to monitor for **unusual traffic patterns** and **suspicious file types** linked to cloud-hosted malware. ### **AWS Response & Broader Implications** An **AWS spokesperson** stated the company enforces **terms prohibiting illegal use** and acts swiftly on abuse reports. However, the incident raises questions about balancing **cloud accessibility** with **security controls**, particularly as threat actors increasingly exploit **trusted infrastructure**. FIN6’s operation demonstrates how **low-complexity phishing**, when paired with **cloud evasion techniques**, can outmaneuver even advanced detection tools—reinforcing the need for **holistic security strategies** that address both **technical and human vulnerabilities**.