Attackers have sought to compromise entities involved in manufacturing machinery, semiconductors, pharmaceuticals, biotechnology, and consumer goods.
U.S.-based supply chain-critical manufacturing organisations have been primarily targeted with the MixShell in-memory malware as part of the sophisticated ZipLine social engineering campaign.
According to research from Check Point, attackers have sought to compromise entities in Switzerland, Japan, and Singapore who are involved in manufacturing machinery, semiconductors, pharmaceuticals, biotechnology, and consumer goods.
Attacks commence with the exploitation of targeted firms' public 'Contact Us' forms to lure employees into entering weeks-long correspondences involving the distribution of non-disclosure agreements before the delivery of malicious ZIP files. Included within the ZIP archives was a Windows LNK file prompting the eventual deployment of the MixShell payload, which allows not only remote command execution, reverse proxying, and persistence but also further network compromise.
"The ZipLine campaign is a wake-up call for every business that believes phishing is just about suspicious links in emails. Attackers are innovating faster than ever – blending human psychology, trusted communication channels, and timely AI-themed lures," said Check Point research threat intelligence group manager Sergey Shykevich, who recommended the adoption of AI-powered security systems and increased vigilance on possible threats.
Written by
Dan Raywood is a B2B journalist with 25 years of experience, including covering cybersecurity for the past 17 years. He has extensively covered topics from Advanced Persistent Threats and nation-state hackers to major data breaches and regulatory changes.
He has spoken at events including 44CON, Infosecurity Europe, RANT Forum, BSides Scotland, Steelcon and the National Cyber Security Show, and served as editor of SC Media UK, Infosecurity Magazine and IT Security Guru. He was also an analyst with 451 Research and a product marketing lead at Tenable.
