FIN6 exploits HR workflows to breach corporate defenses – Source: www.csoonline.com

The financially motivated cybercrime group FIN6, also known as Skeleton Spider, is targeting human resources professionals with an elaborate social engineering scheme that uses fake job applications to deliver malware, according to new research from security analysts.

The campaign begins with attackers posing as job seekers on professional platforms like LinkedIn and Indeed, building rapport with recruiters before following up with phishing emails containing malicious resume links, researchers at cybersecurity firm DomainTools said.

The sophisticated operation leverages the inherent trust between job seekers and HR professionals to bypass traditional security measures.

“By posing as job seekers and initiating conversations through platforms like LinkedIn and Indeed, the group builds rapport with recruiters before delivering phishing messages that lead to malware,” DomainTools said in its report.

The attacks represent a significant escalation in social engineering tactics, exploiting the professional networking ecosystem that millions of recruiters rely on daily.

Unlike traditional mass phishing campaigns, these targeted attacks require considerable reconnaissance and planning, indicating the group’s commitment to higher-value targets.

Cloud infrastructure masks malicious activity

What sets this campaign apart is FIN6’s sophisticated use of trusted cloud services, particularly Amazon Web Services (AWS), to host their malicious infrastructure and evade detection.

The attackers register domains that mimic real applicant names — such as bobbyweisman[.]com and ryanberardi[.]com — typically through GoDaddy’s anonymous registration services. These domains are then mapped to AWS EC2 instances or S3-hosted static sites designed to look like legitimate resume portfolios.

“FIN6 hosts its phishing sites using trusted cloud infrastructure, including AWS,” researchers noted in the report. “These platforms are appealing to attackers due to ease of setup using services like EC2 and S3, low cost with free-tier abuse or use of compromised billing accounts, and cloud IP ranges that are often implicitly trusted by enterprise network filters.”

When contacted about the research findings, an AWS spokesperson said the company “has clear terms that require our customers to use our services in compliance with applicable laws. When we receive reports of potential violations of our terms, we act quickly to review and take steps to disable prohibited content. We value collaboration with the security research community and encourage researchers to report suspected abuse to AWS Trust & Safety through our dedicated abuse reporting process.”

LinkedIn and Indeed did not respond to requests for comment.

Advanced evasion techniques

The fake resume sites employ sophisticated traffic filtering to distinguish between potential victims and security researchers, checking IP reputation, geolocation, operating system fingerprinting, and browser user-agent strings.

Only visitors from residential IP addresses using Windows-based browsers can access malicious content, while traffic from VPNs, cloud infrastructure, or corporate security scanners receives harmless plain-text resumes instead.

“These layered filters ensure that the malicious content is only delivered to actual human recruiters browsing from typical home or office setups, while blocking security scanners and automated crawlers,” the report said.

The sites also require CAPTCHA verification to confirm human presence before delivering malicious ZIP files containing the More_eggs backdoor, a JavaScript-based malware developed by the Venom Spider group.

From POS breaches to enterprise ransomware

FIN6 has evolved significantly since its early days, targeting point-of-sale systems for payment card theft. The group has expanded into broader enterprise threats, including ransomware operations, making them a persistent concern for organizations across industries.

The shift toward targeting HR departments represents a strategic pivot, as these teams often handle sensitive employee data and have legitimate reasons to interact with external contacts.

The More_eggs malware enables credential theft, system access, and follow-on attacks. Once deployed, it can execute commands, steal credentials, and serve as a foothold for ransomware deployment.

“More_eggs is a modular JavaScript backdoor offered as malware-as-a-service that allows for command execution, credential theft, and follow-on payload delivery, often operating in memory to evade detection,” researchers explained.

The effectiveness of simple tactics

The campaign demonstrates how effective targeted phishing techniques can be when combined with cloud infrastructure and sophisticated evasion methods. The success of these attacks highlights the ongoing challenge organizations face in defending against threats that exploit human psychology rather than technical vulnerabilities.

“FIN6’s Skeleton Spider campaign shows how effective low-complexity phishing campaigns can be when paired with cloud infrastructure and advanced evasion,” the report said. “By using realistic job lures, bypassing scanners, and hiding malware behind CAPTCHA walls, they stay ahead of many detection tools.”

The research underscores the importance of comprehensive training programs for HR personnel, who are increasingly targeted by cybercriminals due to their regular interaction with external contacts and handling of unsolicited communications. Organizations should consider implementing additional verification procedures for resume submissions and external communications.

Security teams are advised to implement layered defenses and maintain vigilance for unusual traffic patterns or file types that could indicate compromise. The abuse of legitimate cloud services also raises questions about the balance between accessibility and security in cloud platform design.

The findings suggest that traditional perimeter security approaches may be insufficient against these evolving social engineering tactics, requiring organizations to adopt more holistic security strategies that account for human factors alongside technological defenses.