Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Contagious Interview: DPRK Threat Actors Lure Tech Industry Job Seekers to Install New Variants of Beaver Tail and Invisible Ferret Malware

Summary: Unit 42 reports that DPRK-linked actors in the CL-STA-240 Contagious Interview campaign pose as recruiters on job platforms to get software developers to run malware during fake online interviews, and have shipped a new Qt-compiled BeaverTail downloader for Windows and macOS since as early as July 2024. The new BeaverTail targets 13 cryptocurrency wallet browser extensions (up from nine), then downloads Python and the InvisibleFerret backdoor, which exfiltrates data to the attacker's C2 server.

Bottom line: A developer who runs an interview exercise on a company-owned laptop can hand the DPRK a foothold inside your network, with InvisibleFerret maintaining control and exfiltrating sensitive data - and the same C2 address, 95.164.17[.]24:1224, has been reported by multiple job seekers.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related