Subtle Snail Impersonation Tactics: How HR Representatives Can Engage Employees to Steal Login Credentials

Subtle Snail, an Iran-linked espionage group also tracked as UNC1549 under the Unyielding Wasp (Tortoiseshell) umbrella of the Charming Kitten network, has shifted its focus to European telecom, aerospace and defence firms since June 2022. In a recent wave, the group compromised 34 devices across 11 organisations by masquerading as human resources representatives on LinkedIn.

Victims were lured into fake recruitment processes, downloaded a customized MINIBIKE backdoor payload, and granted attackers persistent, stealthy access to corporate networks. Profiles were created to resemble real HR professionals with authentic-looking domains such as telespazio-careers[.]com and safrangroup-careers[.]com, and LinkedIn messages invited them to apply for bespoke job openings.

The delivery chain sees victims downloading an archive named Application[.]zip or TimeScheduler[.]zip containing a digitally signed setup.exe and a malicious DLL, with the payload then executing via DLL sideloading and establishing an HTTP-based C2 channel using Azure-hosted domains. According to Report, Subtle Snail procures valid code-signing certificates through SSL[.]com and Insight Digital B.V., enabling the infection to evade antivirus detection.