North Korean menace actors have leveraged a pretend Home windows video conferencing utility impersonating FreeConference.com to backdoor developer programs as a part of an ongoing financially-driven marketing campaign dubbed Contagious Interview.
The brand new assault wave, noticed by Singaporean firm Group-IB in mid-August 2024, is yet one more indication that the exercise can also be leveraging native installers for Home windows and Apple macOS to ship malware.
Contagious Interview, additionally tracked as DEV#POPPER, is a malicious marketing campaign orchestrated by a North Korean menace actor tracked by CrowdStrike below the moniker Well-known Chollima.
The assault chains start with a fictitious job interview, tricking job seekers into downloading and operating a Node.js challenge that comprises the BeaverTail downloader malware, which in flip delivers a cross-platform Python backdoor generally known as InvisibleFerret, which is provided with distant management, keylogging, and browser stealing capabilities.
Some iterations of BeaverTail, which additionally features as an info stealer, have manifested within the type of JavaScript malware, sometimes distributed through bogus npm packages as a part of a purported technical evaluation in the course of the interview course of.
However that modified in July 2024 when the Home windows MSI installer and Apple macOS disk picture (DMG) recordsdata masquerading because the reputable MiroTalk video conferencing software program have been found within the wild, performing as a conduit to deploy an up to date model of BeaverTail.
The newest findings from Group-IB, which has attributed the marketing campaign to the notorious Lazarus Group, recommend that the menace actor is continuous to lean on this particular distribution mechanism, the one distinction being that the installer (“FCCCall.msi”) mimics FreeConference.com as a substitute of MiroTalk.
It is believed that the phony installer is downloaded from a web site named freeconference[.]io, which makes use of the identical registrar as the fictional mirotalk[.]web web site.
“Along with Linkedin, Lazarus can also be actively trying to find potential victims on different job search platforms akin to WWR, Moonlight, Upwork, and others,” safety researcher Sharmine Low stated.
“After making preliminary contact, they might usually try to maneuver the dialog onto Telegram, the place they might then ask the potential interviewees to obtain a video conferencing utility, or a Node.js challenge, to carry out a technical job as a part of the interview course of.”
In an indication that the marketing campaign is present process lively refinement, the menace actors have been noticed injecting the malicious JavaScript into each cryptocurrency- and gaming-related repositories. The JavaScript code, for its half, is designed to retrieve the BeaverTail Javascript code from the area ipcheck[.]cloud or regioncheck[.]web.
It is price mentioning right here that this habits was additionally not too long ago highlighted by software program provide chain safety agency Phylum in reference to an npm bundle named helmet-validate, suggesting that the menace actors are concurrently making use of various propagation vectors.
One other notable change is that BeaverTail is now configured to extract information from extra cryptocurrency pockets extensions akin to Kaikas, Rabby, Argent X, and Exodus Web3, along with implementing performance to determine persistence utilizing AnyDesk.
That is not all. BeaverTail’s information-stealing options are actually realized via a set of Python scripts, collectively known as CivetQ, which is able to harvesting cookies, internet browser information, keystrokes, and clipboard content material, and delivering extra scripts. A complete of 74 browser extensions are focused by the malware.
“The malware is ready to steal information from Microsoft Sticky Notes by concentrating on the appliance’s SQLite database recordsdata positioned at `%LocalAppDatapercentPackagesMicrosoft.MicrosoftStickyNotes_8wekyb3d8bbweLocalStateplum.sqlite,` the place person notes are saved in an unencrypted format,” Low stated.
“By querying and extracting information from this database, the malware can retrieve and exfiltrate delicate info from the sufferer’s Sticky Notes utility.”
The emergence of CivetQ factors to a modularized method, whereas additionally underscoring that the instruments are below lively improvement and have been continuously evolving in little increments over the previous few months.
“Lazarus has up to date their ways, upgraded their instruments, and located higher methods to hide their actions,” Low stated. “They present no indicators of easing their efforts, with their marketing campaign concentrating on job seekers extending into 2024 and to the current day. Their assaults have grow to be more and more artistic, and they’re now increasing their attain throughout extra platforms.”
The disclosure comes because the U.S. Federal Bureau of Investigation (FBI) warned of North Korean cyber actors’ aggressive concentrating on of the cryptocurrency trade utilizing “well-disguised” social engineering assaults to facilitate cryptocurrency theft.
“North Korean social engineering schemes are advanced and elaborate, usually compromising victims with subtle technical acumen,” the FBI stated in an advisory launched Tuesday, stating the menace actors scout potential victims by reviewing their social media exercise on skilled networking or employment-related platforms.
“Groups of North Korean malicious cyber actors determine particular DeFi or cryptocurrency-related companies to focus on and try to socially engineer dozens of those firms’ staff to realize unauthorized entry to the corporate’s community.”
