MSTIC has observed at least five methods of trojanized open-source applications containing the malicious payload and shellcode that is tracked as the ZetaNile malware family. The targets were convinced to self-compromise their systems. For this purpose, the attackers lured the target to execute an attacker-provided PDF viewer to see the full content of a job offer. Mandiant described a matching campaign by UNC4034, which sent a fake Amazon job assessment over WhatsApp as an ISO file containing an unsigned, trojanized PuTTY that dropped the AIRDRY.V2 backdoor. Pro tip: a real recruiter will rarely need you to run their SSH client.
