State-Backed Threat Actors Target Security Researchers via Fake Crypto Summit

Threat intelligence researchers at Mandiant have issued an urgent advisory warning of an ongoing social engineering campaign targeting cybersecurity analysts and vulnerability researchers. The attacker group is distributing trojanized PDF invitations for a non-existent global crypto security summit.

When victims open the malicious conference agenda files, an embedded zero-day exploit triggers arbitrary code execution in popular PDF readers, silently dropping a memory-only backdoor payload designed to exfiltrate proprietary exploit PoCs and private source code repositories.

Security teams are advised to enforce strict application sandboxing, restrict execution of unverified PDF macros, and verify speaker invitations directly through trusted out-of-band channels.