Full Report
ESET researchers analyzed a campaign delivering malware bundled with job interview challenges
Analysis Summary
# Threat Actor: DeceptiveDevelopment
## Attribution & Identity
**Attribution:** North Korea-aligned activity cluster.
**Known Aliases and Associated Groups:** Previously described as Contagious Interview and DEV#POPPER. Not currently attributed to a specific known North Korean threat actor, but shares similarities with Lazarus group tactics (e.g., Operation DreamJob).
## Activity Summary
DeceptiveDevelopment targets freelance software developers through spearphishing, posing as headhunters offering fake employment opportunities. Since early 2024 (active since at least November 2023), operators entice victims with coding tests utilizing private GitHub repositories containing trojanized projects. Executing these projects deploys first-stage malware. The cluster's primary objective is financial gain through cryptocurrency theft, with a potential secondary objective of cyberespionage.
## Tactics, Techniques & Procedures
- **Initial Access/Execution:** Distributing trojanized codebases via fake job interview challenges/coding tests hosted on private repositories. Malicious code was hidden in long comments to be off-screen.
- **Data Staging:** InvisibleFerret copies browser databases to the temp folder prior to credential extraction (T1074.001). Files are staged locally before exfiltration (T1074.001).
- **Credential Access:** Stealing data from cryptocurrency wallets, browsers, and password managers.
- **Collection:** Scanning removable media for files (T1025). Clipboard data stealer functionality (T1115).
- **Command and Control:** Utilizing Standard Application Layer Protocols (HTTP/Web Protocols - T1071.001) and Non-Application Layer Protocols (TCP - T1095). Using nonstandard ports (1224, 1244, 1245) (T1571).
- **Persistence/Remote Access:** Installation of AnyDesk (T1219).
- **Exfiltration:** Exfiltration over HTTP C&C (T1041) and FTP (T1071.002, used by InvisibleFerret). Exfiltration via Telegram webhook (ssh\_zcp command, T1567.004). In some cases, only files below a certain size are exfiltrated (T1030).
## Targeting
- **Sectors:** Software development, cryptocurrency, and decentralized finance (DeFi) projects.
- **Geography:** Global (attackers do not distinguish based on geographical location). Observed targeting users on Windows, Linux, and macOS.
- **Victims:** Freelance software developers, ranging from junior to highly experienced professionals involved in crypto projects.
## Tools & Infrastructure
- **Malware Families:**
- **BeaverTail:** Infostealer and downloader.
- **InvisibleFerret:** Infostealer and Remote Access Trojan (RAT).
- **Infrastructure:** C&C communication observed over HTTP and TCP using nonstandard ports (1224, 1244, 1245). Exfiltration via FTP and Telegram webhooks.
## Implications
This campaign demonstrates a persistent, sophisticated tradecraft used by North Korea-aligned actors to directly fund their regime by targeting financially valuable individuals (developers involved in crypto). The use of a seemingly legitimate workflow (job interview/coding tests) as initial access is highly effective at bypassing traditional security controls designed for email-based phishing. The cross-platform malware (Windows, Linux, macOS) ensures a broad attack surface coverage among the targeted developer demographic.
## Mitigations
- Implement stringent vetting processes for job applications involving code submission, especially if hosted on non-corporate controlled repositories.
- Security awareness training specifically addressing "social engineering via employment opportunities," especially for technical staff involved in high-value assets (like crypto keys).
- Security tooling must monitor for the execution of downloaded codebases and look for common indicator patterns like the use of non-standard C2 ports (1224, 1244, 1245) or the installation of remote access tools like AnyDesk.
- Monitor for unusual internal file staging (e.g., copying browser databases to temporary folders) prior to network transmission.
- Ensure endpoint security solutions are configured to detect and block malware originating from benign developer workflow activities.