Datadog Security Labs · Crawled Jul 25, 2026
Tenacious Pungsan: A DPRK threat actor linked to Contagious Interview | Datadog Security Labs
4 IoCs 2 Malware
Read original article ↗
AI Summary
In September 2024, Datadog Security Research identified three malicious npm packages—passports-js, bcrypts-js, and blockscan-api—linked to the DPRK-associated threat actor 'Tenacious Pungsan'. These packages distributed BeaverTail, a JavaScript infostealer and downloader used in the Contagious Interview campaign targeting US tech job-seekers. The malware steals cryptocurrency wallet data, browser credentials, and deploys a second-stage Python backdoor called InvisibleFerret. The activity is tied to known infrastructure and overlaps with prior Contagious Interview TTPs, indicating ongoing targeting of developers.
AI-extracted · verify before operational use
Extracted Entities 2 found
Indicators of Compromise 4 extracted
MITRE ATT&CK TTPs 20 techniques
T1003 OS Credential Dumping · Credential Access T1005 Data from Local System · Collection T1027 Obfuscated Files or Information · Defense Evasion T1056.001 Keylogging · Collection T1056.002 GUI Input Capture · Collection T1059.001 PowerShell · Execution T1059.007 JavaScript · Execution T1071 Application Layer Protocol · Command And Control T1071.001 Web Protocols · Command And Control T1071.003 Mail Protocols · Command And Control T1082 System Information Discovery · Discovery T1083 File and Directory Discovery · Discovery T1113 Screen Capture · Collection T1114 Email Collection · Collection T1123 Audio Capture · Collection T1195.002 Compromise Software Supply Chain · Initial Access T1482 Domain Trust Discovery · Discovery T1490 Inhibit System Recovery · Impact T1555 Credentials from Password Stores · Credential Access T1566 Phishing · Initial Access