InvisibleFerret Archives • Daily CyberSecurity

North Korea-Aligned Void Dokkaebi Evolves with Binary Obfuscation

North Korea-Aligned Void Dokkaebi Evolves with Binary Obfuscation

Do Son May 28, 2026

TrendAI Research exposes the new Void Dokkaebi Cython malware campaign. Learn how InvisibleFerret uses binary compilation to evade security teams.

Inside “HexagonalRodent”: The AI-Powered DPRK Syndicate Hauling Millions in Crypto HexagonalRodent Malware Web3 Developer Scams

Inside “HexagonalRodent”: The AI-Powered DPRK Syndicate Hauling Millions in Crypto

Do Son April 27, 2026

North Korean group HexagonalRodent stole millions in Q1 2026 using AI-generated lures and backdoored VS Code tasks. Protect your Web3 wallet now.

North Korea’s Contagious Interview APT Uses JSON Keeper and GitLab to Deliver BeaverTail Spyware North Korean Laptop Farm DPRK Insider Threat North Korea WMD Cyber Funding, Australia Sanctions Insider threat, North Korean hackers Kimsuky, cyber-espionage NPM Malware, North Korea Cyber-espionage North Korea, Remote IT Job Scam Laptop Farm - DriverEasy - Kimsuky Watering Hole Attack

North Korean Laptop Farm DPRK Insider Threat North Korea WMD Cyber Funding, Australia Sanctions Insider threat, North Korean hackers Kimsuky, cyber-espionage NPM Malware, North Korea Cyber-espionage North Korea, Remote IT Job Scam Laptop Farm - DriverEasy - Kimsuky Watering Hole Attack

North Korea’s Contagious Interview APT Uses JSON Keeper and GitLab to Deliver BeaverTail Spyware

Do Son November 17, 2025

NVISO exposed the Contagious Interview APT using JSON Keeper and npoint.io as covert C2 channels. The North Korean group uses fake job lures on GitLab to deploy BeaverTail to steal Web3 credentials.

North Korea’s UNC5342 APT Uses EtherHiding to Store Malware in Blockchain Smart Contracts for Stealthy C2 North Korea EtherHiding, Blockchain C2

North Korea’s UNC5342 APT Uses EtherHiding to Store Malware in Blockchain Smart Contracts for Stealthy C2

Do Son October 20, 2025

Google exposed UNC5342 (DPRK APT) using EtherHiding—hiding JADESNOW/INVISIBLEFERRET malware in BNB/Ethereum smart contracts—for a resilient, nation-state C2 infrastructure.

North Korean APT “Contagious Interview” Floods npm Registry with 338 Malicious Packages to Steal Crypto North Korean Laptop Farm DPRK Insider Threat North Korea WMD Cyber Funding, Australia Sanctions Insider threat, North Korean hackers Kimsuky, cyber-espionage NPM Malware, North Korea Cyber-espionage North Korea, Remote IT Job Scam Laptop Farm - DriverEasy - Kimsuky Watering Hole Attack

North Korean APT “Contagious Interview” Floods npm Registry with 338 Malicious Packages to Steal Crypto

Do Son October 11, 2025

North Korean actors launched "Contagious Interview," flooding npm with 338 malicious packages to deliver BeaverTail/InvisibleFerret. The campaign targets Web3 developers via fake job offers.

North Korean Hackers Evolve Tactics with New Malware Campaign North Korea malware North Korea, OFAC sanctions DPRK AI hiring, Wagemole campaigns

North Korea malware North Korea, OFAC sanctions DPRK AI hiring, Wagemole campaigns

North Korean Hackers Evolve Tactics with New Malware Campaign

Do Son September 19, 2025

GitLab Threat Intelligence reveals a new North Korean malware campaign using "ClickFix" social engineering to target new industries like crypto and retail.

XORIndex: North Korea’s Evolving Supply Chain Malware Targets npm Ecosystem Again NPM Supply Chain, North Korea Malware

XORIndex: North Korea’s Evolving Supply Chain Malware Targets npm Ecosystem Again

Do Son July 15, 2025

North Korean APTs are using XORIndex malware in a new npm supply chain attack, infiltrating developers via 67 malicious packages to steal crypto wallets and credentials.

North Korean APT Launches Massive npm Supply Chain Attack: Typosquatting & Fake Jobs Steal Crypto from Devs npm Supply Chain Attack, North Korean APT

npm Supply Chain Attack, North Korean APT

North Korean APT Launches Massive npm Supply Chain Attack: Typosquatting & Fake Jobs Steal Crypto from Devs

Do Son June 26, 2025

North Korean APTs are using 35 typosquatted npm packages and fake job offers to spread HexEval, BeaverTail, and InvisibleFerret malware, stealing crypto and data from developers.

North Korean APT ‘Contagious Interview’ Launches Fake Crypto Companies to Spread Malware Trio North Korea malware North Korea, OFAC sanctions DPRK AI hiring, Wagemole campaigns

North Korean APT ‘Contagious Interview’ Launches Fake Crypto Companies to Spread Malware Trio

Do Son April 28, 2025

Silent Push uncovers Lazarus Group's campaign using fake crypto job offers to spread malware (BeaverTail, InvisibleFerret, OtterCookie), targeting job seekers.

North Korea’s IT Worker Scam: How the Regime Infiltrates Global Tech Firms for Cyber Espionage

Do Son February 16, 2025

Uncover the dangers of North Korea’s IT worker scam. Learn how it threatens global tech with espionage and fraud.

“OtterCookie” Malware Nibbles at Developers in “Contagious Interview” Campaign SonicWall Reconnaissance Akira Ransomware residential proxy malware TraderTraitor BreachForums Honeypot, French Interior Ministry Leak

SonicWall Reconnaissance Akira Ransomware residential proxy malware TraderTraitor BreachForums Honeypot, French Interior Ministry Leak

“OtterCookie” Malware Nibbles at Developers in “Contagious Interview” Campaign

Do Son December 26, 2024

Discover the dangers of OtterCookie, a sneaky malware targeting software developers. Find out how it infiltrates systems and steals sensitive data.

Cyber Espionage Campaign: North Korean Actors Deploy BeaverTail and InvisibleFerret North Korean Cyber Tactics

Cyber Espionage Campaign: North Korean Actors Deploy BeaverTail and InvisibleFerret

Do Son November 15, 2024

Uncover the evolving tactics of North Korean cybercriminals. Learn how the BeaverTail and InvisibleFerret malware strains exploit software developers and their systems.

Contagious Interview & WageMole: North Korea’s New Cyber Espionage Campaigns WageMole campaign

Contagious Interview & WageMole: North Korea’s New Cyber Espionage Campaigns

Do Son November 6, 2024

Uncover the deceptive strategies of North Korean threat actors infiltrating Western job markets through the Contagious Interview and WageMole campaigns.

North Korean Cyber Espionage Group Tenacious Pungsan Compromises Open-Source Repositories with Backdoored npm Packages Mercenary Akula European Financial Targeting AI-Generated Malware React2Shell Exploit UAT-8837 Critical Infrastructure Attack APT36, BOSS Linux BRICKSTORM Malware, China Espionage Curly COMrades, MucorAgent Chinese APT - HTTP Client Tools Shuckworm Cyber Espionage

Mercenary Akula European Financial Targeting AI-Generated Malware React2Shell Exploit UAT-8837 Critical Infrastructure Attack APT36, BOSS Linux BRICKSTORM Malware, China Espionage Curly COMrades, MucorAgent Chinese APT - HTTP Client Tools Shuckworm Cyber Espionage

North Korean Cyber Espionage Group Tenacious Pungsan Compromises Open-Source Repositories with Backdoored npm Packages

Do Son October 24, 2024

Uncover the malicious activities of the Tenacious Pungsan group. Learn how they target developers through name-squatting attacks on popular npm packages.

North Korean Threat Actors Targeting Tech Job Seekers with Contagious Interview Campaign

Do Son October 9, 2024

Beware of the Contagious Interview campaign: North Korean threat actors posing as recruiters target tech job seekers with malware.

North Korean Hackers Launch Job Interview Scam to Deploy BeaverTail and InvisibleFerret Malware BeaverTail malware

North Korean Hackers Launch Job Interview Scam to Deploy BeaverTail and InvisibleFerret Malware

Do Son September 5, 2024

Protect yourself from the BeaverTail malware and InvisibleFerret backdoor used by Lazarus Group. Learn how the Contagious Interview campaign targets blockchain professionals and job seekers through deceptive tactics.

Beware DEV#POPPER: Evolving Malware Targets Developers Everywhere

Do Son August 4, 2024

Stay informed about the DEV#POPPER campaign by North Korean hackers. Learn how they target software developers and what precautions to take.