North Korean Hackers Exploit False Conversations to Spread Developers with Cross-Platform Malware
Threat actors associated with North Korea have been identified targeting job seekers in the technology sector to propagate updated versions of known malware families recognized as BeaverTail and InvisibleFerret.
The cluster of actions, identified as CL-STA-0240, forms part of an initiative named Contagious Interview that was initially revealed by Palo Alto Networks Unit 42 in November 2023.
“The threat actor linked with CL-STA-0240 reaches out to software developers via job search platforms by pretending to be a potential employer,” Unit 42 clarified in a recent report published on their site.
“The hackers invite the victim to engage in an online discussion, where the threat actor persuades the victim to download and install malware.”
The initial phase of the attack incorporates the BeaverTail downloader and information thief crafted to target both Windows and Apple macOS systems. The malware serves as a pathway for the Python-based InvisibleFerret backdoor.
Reports indicate that the activity remains ongoing even after being publicly disclosed, suggesting that the threat actors responsible for the operation are successfully enticing developers to execute harmful code under the pretense of a coding task.
Security analyst Patrick Wardle and cybersecurity firm Group-IB, in two recent assessments, outlined an exploit sequence that utilized fake Windows and macOS video conferencing apps impersonating MiroTalk and FreeConference.com to infiltrate developer systems with BeaverTail and InvisibleFerret.
Noteworthy is the fact that the false application is built using Qt, which facilitates cross-compilation for both Windows and macOS. The Qt-based edition of BeaverTail can pilfer browser passwords and collect data from various cryptocurrency wallets.
Besides sending the data to a server controlled by the adversary, BeaverTail is programmed to fetch and run the InvisibleFerret backdoor, which comprises two components –
- A primary payload enabling host fingerprinting, remote control, keylogging, data extraction, and retrieval of AnyDesk
- A browser thief that gathers browser credentials and credit card details
“North Korean threat actors engage in financial offenses to secure funds for the DPRK regime,” Unit 42 mentioned. “This campaign might be financially driven, given that the BeaverTail malware can steal 13 different cryptocurrency wallets.”
About Author
