North Korean hackers broke into corporate networks by pretending to be Meta recruiters on LinkedIn, and sent engineers fake coding assignments that were actually trojans.

Unanswered questions in my mind:

1. Why would you run a coding exercise, given to you by a recruiter for another company, on the laptop you use in your current job?

2. Why are there engineers out there who don't feel alarmed to receive an "assignment.exe" file rather than "assignment.txt"?

3. None of those engineers felt like something was fishy when they received a coding assignment from Meta that simply asked them to write a script that prints Fibonacci numbers?

4. None of those engineers felt that there was something wrong with assignments being shared uniquely through LinkedIn messages, without ever hitting the mailbox with an official @facebook.com email address?

We engineers often think of ourselves as the strong link in the security chain. We think highly of our technical skills, we would never fall into a boomer trap and click on a random unsolicited link received on a, random social media website.

Right? Right....?

https://www.welivesecurity.com/en/eset-research/lazarus-luring-employees-trojanized-coding-challenges-case-spanish-aerospace-company/