ZERO SECURITY announced that records relating to 52 Japan-related service domains had been found on 22 of the 80 devices analyzed. The report also outlined the nature of cyber threats targeting points of contact in recruitment and outsourcing, along with key countermeasures.
According to the analysis results disclosed by ZERO SECURITY, the investigation covered 80 devices, and URLs were extracted from 296 credential dump files. Records relating to 52 Japan-related service domains were confirmed on 22 devices, suggesting that Japanese companies may have connections with employment or business services. The analysis did not include ID or password values, and it was emphasized that the scale of any damage could not be determined.
ZERO SECURITY identified two primary routes: impersonating recruiters or business partners to prompt targets to run challenge code or tools, and using false identities to participate in employment or outsourcing arrangements, creating a risk that legitimate privileges could be misused. This could result in the leakage of credentials, sessions and business materials when devices are infected, with potential impacts extending beyond email to source-code repositories, cloud administration, internal documents and customer information.
Countermeasures cited include coordination between recruitment and contracting teams and security teams, verifying the identity match of applicants and contractors and whether subcontracting is involved, validating code and tools provided by applicants or contractors and checking them in an isolated environment, operating with least privilege after work begins and separating approval duties, reviewing access logs, and revoking and deleting access rights when contracts end. The recommended approach is to make decisions based on personal identity information and work-related conduct, rather than nationality or name.