Russian, North Korean threat actors use Internet Explorer and LinkedIn to cause trouble

Nowhere on the internet is truly safe, and Google’s report on recent threats serves to remind users of that fact (via Ars Technica). In the report, which cites numerous cyberattacks, two unlikely foundations for online villainy were listed: LinkedIn and Internet Explorer.

For example, a threat detected on March 19, 2021, by Google’s Threat Analysis Group (TAG) involved a Russian actor (likely government-backed, according to TAG) using LinkedIn Messaging to go after western European government officials. If the officials clicked the link in the message, they’d end up at a domain that would hit them with malicious payloads.

Google also outlined what happened with Internet Explorer earlier this year at the hands of North Korean attackers. To quote the report: “Earlier this year, North Korean attackers distributed MHT files embedding an exploit for CVE-2021-26411. These files are automatically opened in Internet Explorer when they are double clicked by the user.”

Don’t forget that Internet Explorer is entering formal retirement in 2022, meaning it’s about as close to obsolete as a still-used browser can get. Yet it was a prime hub for ill-intentioned activity.

And these incidents are the tip of the iceberg. Recently, a Chinese group went after SolarWinds, a company that has suffered its fair share of attacks already this year at the hands of Russians.

Cybercrime is a daily occurrence, and the heightening frequency of large-scale attacks has become more and more apparent over the past few years. The question remains as to what can be done about it, given that detecting the problem is only half the battle.