Inside Two Multi-Stage Attack Chains Hiding Behind Job Offers

Key Findings Both chains open with a fake recruiter. A file that looks like a job description or an interview document arrives from someone posing as a hiring contact. One double-click is the only victim action either chain requires. Everything after that runs without further interaction. Campaign 1 overlaps with a known Vietnam-nexus criminal cluster. The PureRAT command-and-control address and port recovered from this sample, 15[.]235[.]156[.]143 on 56001, match…

Diamond Model