ANY.RUN Exposes North Korean ‘Fake Interview’ Campaign: BeaverTail Loader Deploys InvisibleFerret Malware

DUBAI, DUBAI, UNITED ARAB EMIRATES, January 21, 2025 /EINPresswire.com/ -- ANY.RUN released technical research on a new wave of North Korean-linked malware campaigns disguised as job interviews. 𝗕𝗲𝗮𝘃𝗲𝗿𝗧𝗮𝗶𝗹, a JavaScript-based loader, deploys 𝗜𝗻𝘃𝗶𝘀𝗶𝗯𝗹𝗲𝗙𝗲𝗿𝗿𝗲𝘁, a Python stealer designed to steal crypto wallets, source code, and more. By posing coding challenges and software installs, attackers trick victims into downloading malicious components.

𝐊𝐞𝐲 𝐓𝐚𝐤𝐞𝐚𝐰𝐚𝐲𝐬 𝐟𝐫𝐨𝐦 𝐓𝐞𝐜𝐡𝐧𝐢𝐜𝐚𝐥 𝐀𝐧𝐚𝐥𝐲𝐬𝐢𝐬

Below are the key findings from ANY.RUN technical analysis:

· 𝗧𝗮𝗿𝗴𝗲𝘁𝗲𝗱 𝗶𝗻𝗱𝘂𝘀𝘁𝗿𝗶𝗲𝘀 𝗮𝗻𝗱 𝗿𝗼𝗹𝗲𝘀: Campaigns primarily affect technology, finance, and crypto organizations, specifically targeting developers and engineers with job-related lures.
· 𝗡𝗲𝘅𝘁-𝘀𝘁𝗮𝗴𝗲 𝗽𝗮𝘆𝗹𝗼𝗮𝗱: BeaverTail downloads a Python environment to deploy InvisibleFerret, which can kill browser processes, exfiltrate files, and persist in the system.
· 𝗠𝘂𝗹𝘁𝗶𝗽𝗹𝗲 𝗲𝘅𝗳𝗶𝗹𝘁𝗿𝗮𝘁𝗶𝗼𝗻 𝗺𝗲𝘁𝗵𝗼𝗱𝘀: Depending on configuration, attackers can push stolen data over FTP, SMTP, or Telegram.
· 𝗧𝗿𝗮𝗻𝘀𝗽𝗮𝗿𝗲𝗻𝗰𝘆 𝘃𝗶𝗮 𝗔𝗡𝗬.𝗥𝗨𝗡: The platform’s real-time timeline view and thorough TTP mapping provide actionable intelligence for security teams.

For the full deep dive, including IOCs and technical breakdowns, see ANY.RUN’s blog.

𝐈𝐦𝐩𝐥𝐢𝐜𝐚𝐭𝐢𝐨𝐧𝐬 𝐟𝐨𝐫 𝐁𝐮𝐬𝐢𝐧𝐞𝐬𝐬𝐞𝐬

This campaign highlights how attackers disguise malware as ordinary job tasks, making it easy for even well-defended organizations to be caught off guard. Companies in tech and crypto should use advanced sandbox analysis for suspicious files and attachments. Regular monitoring of development environments and stronger access controls can help prevent these covert infiltration attempts and protect valuable corporate assets.

𝐀𝐛𝐨𝐮𝐭 𝐀𝐍𝐘.𝐑𝐔𝐍

ANY.RUN is a trusted provider of cybersecurity solutions used by over 500,000 professionals. By offering real-time sandbox environments for Windows and Linux, along with advanced threat intelligence tools and team collaboration features, ANY.RUN empowers organizations to detect, analyze, and counteract cyber threats efficiently.

The ANY.RUN team
ANYRUN FZCO
email us here
+1 657-366-5050
Visit us on social media:
X
LinkedIn