Multiple western organizations · 21/11/2023
Researchers from Palo Alto Networks reveal the details of "Contagious Interview" or " CL-STA-0240,” a campaign targeting western organizations where threat actors posed as employers (often anonymously or with vague identities) to lure software developers into installing malware through the interview process. [Date Occurred: As early as December 2022; Date Discovered: As early as March 2023]
Multiple organizations in the U.S. and Africa · 21/11/2023
Researchers from Palo Alto Networks reveal the details of "Wagemole" or " CL-STA-0241,” an additional campaign targeting western organizations in U.S. and Africa (often anonymously or with vague identities) to lure software developers into installing malware through the interview process. [Date Occurred: As early as August 2022; Date Discovered: As early as March 2023]
https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters · November
Annex 59: List of DPRK Cyberthreat actors’ malicious activities monitored by the Panel in 2023 (row 66 of 75, PDF p. 330). DPRK cyber actor: DPRK cyber actors; Report Name: https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters; Case Summary: DPRK cyber actors pose as employers, utilizing advertisements on job search platforms and potentially email, social media, or chat platforms, to lure software developers into installing malware (hosted on Github) through the interview process, providing th e DPRK actors opportunity to steal intellectual property, funds, and/or other information. The investigation also identified two new malware families, BeaverTail and InvisibleFerret.; Publication Month: November
“Hacking Employers and Seeking Employment: Two Job-Related Campaigns Bear Hallmarks of North Korean Threat Actors,” Palo Alto Networks · 21 November 2023
Annex 99 (Select reports of DPRK cyber actors targeting the cryptocurrency industry), report 9: “Hacking Employers and Seeking Employment: Two Job-Related Campaigns Bear Hallmarks of North Korean Threat Actors,” Palo Alto Networks, 21 November 2023. Summary: In a campaign dubbed “Contagious Interview”, DPRK cyber actors are posing as employers – utilizing advertisements on job search platforms and potentially email, social media, or chat platforms – to lure software developers into installing malware (hosted on Github) through the interview process, providing the DPRK actors opportunity to steal intellectual property, funds, and/or other information. The investigation also identified two new malware families, BeaverTail and InvisibleFerret.
Hacking Employers and Seeking Employment: Two Job-Related Campaigns Bear Hallmarks of North Korean Threat Actors · 2023-11-21T06:00:48
Two ongoing campaigns bear hallmarks of North Korean state-sponsored threat actors, posing in job-seeking roles to distribute malware or conduct espionage.