Malware

FlexibleFerret

Indicators of Compromise 1

Domain mouse-review[.]discord[.]gg

MITRE ATT&CK TTPs 8

T1021.003
Distributed Component Object Model
Lateral Movement
 T1059
Command and Scripting Interpreter
Execution
 T1071
Application Layer Protocol
Command And Control
 T1071.001
Web Protocols
Command And Control
 T1204.002
Malicious File
Execution
 T1566
Phishing
Initial Access
 T1566.001
Spearphishing Attachment
Initial Access
 T1573
Encrypted Channel
Command And Control

Source Articles

Contagious Interview Campaign Compromises 30,000 Devices, Steals $10.71M in Crypto
North Korean threat actors associated with the Contagious Interview campaign have compromised over 30,000 devices across more than 100 countries since at least 2022, targeting software developers and IT professionals in cryptocurrency, blockchain, and Web3 sectors. The attackers pose as recruiters on platforms like LinkedIn, offering fake job opportunities that lead to multi-stage malware infections. Malware families deployed include BeaverTail, InvisibleFerret, and RATatouille, enabling credential theft, cryptocurrency theft, and lateral movement into corporate networks. A related operation uses Western proxies recruited via Discord to bypass sanctions and identity checks, with North Korean IT workers using AI-generated identities to secure remote jobs and steal funds.
hacker-news ·4h ago