Hackers backed by the North Korean government are weaponizing well-known pieces of open source software in an ongoing campaign that has already succeeded in compromising "numerous" organizations in the media, defense and aerospace, and IT services industries, Microsoft said on Thursday.The hackers then pose as job recruiters and connect with individuals of targeted organizations over LinkedIn."The actors have successfully compromised numerous organizations since June 2022," members of the Microsoft Security Threat Intelligence and LinkedIn Threat Prevention and Defense teams wrote in a post.The post went on:Within the trojanized version of muPDF/Subliminal Recording installer, setup.exe is configured to check if the file path ISSetupPrerequisitesSetup64.exe exists and write C:colrctlcolorui.dll on disk after extracting the embedded executable inside setup.exe.The DLL colorui.dll, which Microsoft is tracking as the EventHorizon malware family, is injected into C:WindowsSystemcredwiz.exe or iexpress.exe to send C2 HTTP requests as part of the victim check-in process and to get an additional payload."