{"id":22716,"date":"2025-07-15T00:05:00","date_gmt":"2025-07-15T03:05:00","guid":{"rendered":"https:\/\/www.ethicalhacker.com.br\/site\/?p=22716"},"modified":"2025-07-12T16:30:35","modified_gmt":"2025-07-12T19:30:35","slug":"hackers-como-candidatos-infiltrados","status":"publish","type":"post","link":"https:\/\/www.ethicalhacker.com.br\/site\/2025\/07\/exploits\/hackers-como-candidatos-infiltrados\/","title":{"rendered":"Hackers como \u201ccandidatos\u201d infiltrados"},"content":{"rendered":"\n<p data-start=\"44\" data-end=\"127\"><strong>A Nova Fronteira da Amea\u00e7a: Hackers Norte-Coreanos como \u201cCandidatos\u201d Infiltrados<\/strong><\/p>\n<p style=\"text-align: justify;\" data-start=\"129\" data-end=\"166\"><span class=\"relative -mx-px my-[-0.2rem] rounded px-px py-[0.2rem] transition-colors duration-100 ease-in-out\">O phishing evoluiu. Agora, na esteira do trabalho remoto, um ator extraordinariamente organizado \u2014 o regime da Coreia do Norte \u2014 adota <strong data-start=\"135\" data-end=\"159\">fic\u00e7\u00f5es estruturadas<\/strong>, onde profissionais s\u00e3o recrutados a partir de canais leg\u00edtimos para infiltra\u00e7\u00e3o corporativa. \u00c9 a face mais recente da engenharia social: <strong data-start=\"298\" data-end=\"347\">ataques disfar\u00e7ados de entrevistas de emprego<\/strong>.<\/span><\/p>\n<p data-start=\"129\" data-end=\"166\">\u00a0<\/p>\n<p data-start=\"173\" data-end=\"223\"><strong>Estrat\u00e9gia maliciosa usando portais de emprego<\/strong><\/p>\n<p style=\"text-align: justify;\" data-start=\"225\" data-end=\"300\"><span class=\"relative -mx-px my-[-0.2rem] rounded px-px py-[0.2rem] transition-colors duration-100 ease-in-out\">Grupos como <em data-start=\"12\" data-end=\"29\">Famous Chollima<\/em>, vinculados ao governo norte-coreano, criam <strong data-start=\"74\" data-end=\"107\">plataformas de sele\u00e7\u00e3o falsas<\/strong> que imitam empresas renomadas (como Coinbase, Robinhood, Uniswap), atraiam profissionais \u2014 especialmente do setor de criptomoedas \u2014 e prop\u00f5em avalia\u00e7\u00f5es t\u00e9cnicas como testes de v\u00eddeo ou instala\u00e7\u00e3o de ferramentas como &#8220;CameraAccess&#8221; e &#8220;VCam&#8221;\u202f<\/span>.<\/p>\n<p style=\"text-align: justify;\" data-start=\"302\" data-end=\"377\"><span class=\"relative -mx-px my-[-0.2rem] rounded px-px py-[0.2rem] transition-colors duration-100 ease-in-out\">Esse pretexto \u00e9 usado para induzir os candidatos a executar comandos maliciosos, instalando trojans RAT como o \u201cPylangGhost\u201d, capaz de extrair credenciais, cookies e extens\u00f5es de navegador, deixando backdoors para espionagem ou exfiltra\u00e7\u00e3o de dados<\/span>.<\/p>\n<p data-start=\"302\" data-end=\"377\">\u00a0<\/p>\n<p data-start=\"384\" data-end=\"436\"><strong>Impacto real: espionagem e roubo de criptoativos<\/strong><\/p>\n<p style=\"text-align: justify;\" data-start=\"438\" data-end=\"513\"><span class=\"relative -mx-px my-[-0.2rem] rounded px-px py-[0.2rem] transition-colors duration-100 ease-in-out\">Essas opera\u00e7\u00f5es n\u00e3o s\u00e3o isoladas ou experimentais: est\u00e3o vinculadas a campanhas globais de infiltra\u00e7\u00e3o de empresas e profissionais de cripto. Estima-se que hackers norte-coreanos tenham exfiltrado mais de <strong data-start=\"205\" data-end=\"223\">US$\u202f1,6\u202fbilh\u00e3o<\/strong> em ativos digitais apenas no primeiro semestre de 2025<\/span>.<\/p>\n<p style=\"text-align: justify;\" data-start=\"515\" data-end=\"590\"><span class=\"relative -mx-px my-[-0.2rem] rounded px-px py-[0.2rem] transition-colors duration-100 ease-in-out\">Al\u00e9m disso, a abordagem de candidatos remotos via \u201claptop farms\u201d \u2014 em que facilitadores compram laptops f\u00edsicos e os alugam a hackers norte-coreanos \u2014 j\u00e1 gerou centenas de milh\u00f5es de d\u00f3lares para o regime, infiltrando empresas de tecnologia americana<\/span>.<\/p>\n<p data-start=\"515\" data-end=\"590\">\u00a0<\/p>\n<p data-start=\"597\" data-end=\"645\"><strong>Vetor de ataque: desde o curr\u00edculo at\u00e9 o RAT<\/strong><\/p>\n<p data-start=\"647\" data-end=\"695\">O fluxo malicioso geralmente segue estas etapas:<\/p>\n<ul data-start=\"697\" data-end=\"1142\">\n<li data-start=\"697\" data-end=\"775\">\n<p data-start=\"700\" data-end=\"775\"><strong data-start=\"700\" data-end=\"733\">Cria\u00e7\u00e3o de perfil fraudulento<\/strong> \u2014 uso de identidade roubada ou fabricada.<\/p>\n<\/li>\n<li data-start=\"776\" data-end=\"872\">\n<p data-start=\"779\" data-end=\"872\"><strong data-start=\"779\" data-end=\"809\">Oferta de vaga convincente<\/strong> \u2014 divulga\u00e7\u00e3o em redes profissionais ou plataformas de emprego.<\/p>\n<\/li>\n<li data-start=\"873\" data-end=\"960\">\n<p data-start=\"876\" data-end=\"960\"><strong data-start=\"876\" data-end=\"902\">Teste t\u00e9cnico realista<\/strong> \u2014 uso de ferramentas aparentemente leg\u00edtimas (ex.: VCam).<\/p>\n<\/li>\n<li data-start=\"961\" data-end=\"1037\">\n<p data-start=\"964\" data-end=\"1037\"><strong data-start=\"964\" data-end=\"989\">Instala\u00e7\u00e3o de malware<\/strong> \u2014 trojan RAT para espionagem e controle remoto.<\/p>\n<\/li>\n<li data-start=\"1038\" data-end=\"1142\">\n<p data-start=\"1041\" data-end=\"1142\"><strong data-start=\"1041\" data-end=\"1060\">Acesso cont\u00ednuo<\/strong> \u2014 uso da sess\u00e3o e dispositivo infectado para movimenta\u00e7\u00e3o lateral ou exfiltra\u00e7\u00e3o.<\/p>\n<\/li>\n<\/ul>\n<p style=\"text-align: justify;\" data-start=\"1144\" data-end=\"1293\">Essa sequ\u00eancia combina engenharia social com instala\u00e7\u00e3o t\u00e9cnica de malware, enquadrando-se entre os ataques mais sofisticados e dif\u00edceis de detectar.<\/p>\n<p data-start=\"1144\" data-end=\"1293\">\u00a0<\/p>\n<p data-start=\"1300\" data-end=\"1338\"><strong>Como mitigar esse cen\u00e1rio perigoso<\/strong><\/p>\n<p data-start=\"1340\" data-end=\"1406\">Para conter essa amea\u00e7a \u00fanica, a defesa deve ser multidimensional:<\/p>\n<ul data-start=\"1408\" data-end=\"1967\">\n<li data-start=\"1408\" data-end=\"1532\">\n<p style=\"text-align: justify;\" data-start=\"1410\" data-end=\"1532\"><strong data-start=\"1410\" data-end=\"1448\">Verifica\u00e7\u00e3o rigorosa de identidade<\/strong> \u2014 pol\u00edticas que exigem autentica\u00e7\u00e3o presencial em entrevistas para vagas sens\u00edveis.<\/p>\n<\/li>\n<li data-start=\"1533\" data-end=\"1650\">\n<p style=\"text-align: justify;\" data-start=\"1535\" data-end=\"1650\"><strong data-start=\"1535\" data-end=\"1572\">Revis\u00e3o de ferramentas de sele\u00e7\u00e3o<\/strong> \u2014 an\u00e1lise minuciosa de pacotes instalados automaticamente em testes t\u00e9cnicos.<\/p>\n<\/li>\n<li data-start=\"1651\" data-end=\"1749\">\n<p style=\"text-align: justify;\" data-start=\"1653\" data-end=\"1749\"><strong data-start=\"1653\" data-end=\"1683\">Monitoramento de endpoints<\/strong> \u2014 detec\u00e7\u00e3o de RATs, comportamentos suspeitos e anomalias na rede.<\/p>\n<\/li>\n<li data-start=\"1750\" data-end=\"1855\">\n<p style=\"text-align: justify;\" data-start=\"1752\" data-end=\"1855\"><strong data-start=\"1752\" data-end=\"1792\">Educa\u00e7\u00e3o e simula\u00e7\u00f5es personalizadas<\/strong> \u2014 capacitar equipes de RH e TI a identificar sinais de fraude.<\/p>\n<\/li>\n<li data-start=\"1856\" data-end=\"1967\">\n<p style=\"text-align: justify;\" data-start=\"1858\" data-end=\"1967\"><strong data-start=\"1858\" data-end=\"1895\">Controle de hardware de terceiros<\/strong> \u2014 proibi\u00e7\u00e3o ou registro estrito de laptops fornecidos por recrutadores.<\/p>\n<\/li>\n<\/ul>\n<p>\u00a0<\/p>\n<p data-start=\"1974\" data-end=\"1986\"><strong>Conclus\u00e3o<\/strong><\/p>\n<p style=\"text-align: justify;\" data-start=\"1988\" data-end=\"2309\">Ao fingir candidaturas de emprego, hackers norte-coreanos transformaram o processo seletivo em <strong data-start=\"2083\" data-end=\"2117\">vetor de infiltra\u00e7\u00e3o insidioso<\/strong>, que combina engenharia social, identidade falsa e malware avan\u00e7ado. Empresas e candidatos precisam compreender que entrevistas online \u2014 especialmente t\u00e9cnicas \u2014 podem ocultar amea\u00e7as s\u00e9rias.<\/p>\n<p style=\"text-align: justify;\" data-start=\"2311\" data-end=\"2647\">A melhor defesa envolve <strong data-start=\"2335\" data-end=\"2376\">mecanismos de valida\u00e7\u00e3o de identidade<\/strong>, <strong data-start=\"2378\" data-end=\"2425\">rigor na instala\u00e7\u00e3o de softwares de sele\u00e7\u00e3o<\/strong> e <strong data-start=\"2428\" data-end=\"2480\">monitoramento constante de seguran\u00e7a no endpoint<\/strong>. Quanto mais sofisticado o ataque, mais sofisticada deve ser a resposta, garantindo que processos de contrata\u00e7\u00e3o n\u00e3o se convertam em brechas de seguran\u00e7a cibern\u00e9tica.<\/p>\n<p data-start=\"2654\" data-end=\"2669\">\u00a0<\/p>\n<p data-start=\"2654\" data-end=\"2669\"><strong>Refer\u00eancias Bibliograficas:<\/strong>\u00a0<\/p>\n<ul data-start=\"2671\" data-end=\"3744\">\n<li data-start=\"2671\" data-end=\"2995\">\n<p data-start=\"2674\" data-end=\"2995\">Collins J. Okoth. (20 jun.\u202f2025). <em data-start=\"2708\" data-end=\"2808\">Hackers norte-coreanos visam candidatos a emprego de criptografia com malware Python (PylangGhost)<\/em>. Cryptopolitan.<br data-start=\"2824\" data-end=\"2827\" \/>Dispon\u00edvel em: <a class=\"cursor-pointer\" href=\"https:\/\/www.cryptopolitan.com\/pt\/north-korean-hackers-target-job-seekers\/\" target=\"_blank\" rel=\"noopener\" data-start=\"2845\" data-end=\"2995\">https:\/\/www.cryptopolitan.com\/pt\/north-korean-hackers-target-job-seekers\/<\/a><\/p>\n<\/li>\n<li data-start=\"2997\" data-end=\"3337\">\n<p data-start=\"3000\" data-end=\"3337\">The Hacker News. (1 jul.\u202f2025). <em data-start=\"3032\" data-end=\"3110\">U.S. Arrests Facilitator in North Korean IT Worker Scheme; Seizes 29 Domains<\/em> \u2014 esquema usando identidades falsas e \u201claptop farms\u201d.<br data-start=\"3164\" data-end=\"3167\" \/>Dispon\u00edvel em: <a class=\"cursor-pointer\" href=\"https:\/\/thehackernews.com\/2025\/07\/us-arrests-key-facilitator-in-north.html\" target=\"_blank\" rel=\"noopener\" data-start=\"3185\" data-end=\"3337\">https:\/\/thehackernews.com\/2025\/07\/us-arrests-key-facilitator-in-north.html<\/a><\/p>\n<\/li>\n<li data-start=\"3339\" data-end=\"3744\">\n<p data-start=\"3342\" data-end=\"3744\">Reuters. (24 abr.\u202f2025). <em data-start=\"3367\" data-end=\"3438\">North Korean cyber spies created U.S. firms to dupe crypto developers<\/em>.<br data-start=\"3439\" data-end=\"3442\" \/>Dispon\u00edvel em: <a class=\"cursor-pointer\" href=\"https:\/\/www.reuters.com\/sustainability\/boards-policy-regulation\/north-korean-cyber-spies-created-us-firms-dupe-crypto-developers-2025-04-24\/\" target=\"_blank\" rel=\"noopener\" data-start=\"3460\" data-end=\"3744\">https:\/\/www.reuters.com\/sustainability\/boards-policy-regulation\/north-korean-cyber-spies-created-us-firms-dupe-crypto-developers-2025-04-24\/<\/a><\/p>\n<\/li>\n<\/ul>\n\n\n\n\n","protected":false},"excerpt":{"rendered":"<p>A Nova Fronteira da Amea\u00e7a: Hackers Norte-Coreanos como \u201cCandidatos\u201d Infiltrados O phishing evoluiu. Agora, na esteira do trabalho remoto, um ator extraordinariamente organizado \u2014 o regime da Coreia do Norte \u2014 adota fic\u00e7\u00f5es estruturadas, onde profissionais s\u00e3o recrutados a partir de canais leg\u00edtimos para infiltra\u00e7\u00e3o corporativa. \u00c9 a face mais recente da engenharia social: ataques [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":22719,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[89,100,21,105],"tags":[],"class_list":["post-22716","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-basico","category-diversos","category-exploits","category-noticias"],"_links":{"self":[{"href":"https:\/\/www.ethicalhacker.com.br\/site\/wp-json\/wp\/v2\/posts\/22716","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ethicalhacker.com.br\/site\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ethicalhacker.com.br\/site\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ethicalhacker.com.br\/site\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ethicalhacker.com.br\/site\/wp-json\/wp\/v2\/comments?post=22716"}],"version-history":[{"count":2,"href":"https:\/\/www.ethicalhacker.com.br\/site\/wp-json\/wp\/v2\/posts\/22716\/revisions"}],"predecessor-version":[{"id":22718,"href":"https:\/\/www.ethicalhacker.com.br\/site\/wp-json\/wp\/v2\/posts\/22716\/revisions\/22718"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.ethicalhacker.com.br\/site\/wp-json\/wp\/v2\/media\/22719"}],"wp:attachment":[{"href":"https:\/\/www.ethicalhacker.com.br\/site\/wp-json\/wp\/v2\/media?parent=22716"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ethicalhacker.com.br\/site\/wp-json\/wp\/v2\/categories?post=22716"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ethicalhacker.com.br\/site\/wp-json\/wp\/v2\/tags?post=22716"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}