Read more about North Korean fake IT workers:
- US Government Warns Firms to Avoid Hiring North Korean IT Workers
- North Korean Hackers Targeted Cybersecurity Firm KnowBe4 with Fake IT Worker
- North Korea Escalates Fake IT Worker Schemes to Extort Employers
North Korean hackers have used the BeaverTail malware in phishing campaigns that target job seekers in the technology sector via fake recruiters, according to Palo Alto Networks.
Unit 42, Palo Alto’s research team, observed that a North Korean IT worker activity cluster tracked as CL-STA-0237 and likely operating from Laos, was involved in recent phishing attacks using BeaverTail-infected video conference apps.
Background on BeaverTail
The BeaverTail malware is distributed through files disguised as legitimate applications, such as MiroTalk and FreeConference, deceiving victims into installing the malicious software.
Details about BeaverTail were initially reported by Unit 42 in November 2023.
Twelve months ago, the malware was used as a part of a phishing campaign called ‘Contagious Interview ‘ involving a North Korean threat cluster tracked as CL-STA-240.
The campaign has since evolved, with new malware versions including a downloader compiled using the cross-platform Qt framework. This allows attackers to deploy malware on both macOS and Windows systems from a single source code.
Additionally, code updates have been made to the InvisibleFerret backdoor, which enables further control of infected devices.
Get the Job, Then Spread Malware
In a new report published on November 14, 2024, Unit 42 observed CL-STA-0237, another North Korean threat group, leveraging BeaverTail for a campaign that started as early as 2022.
First, CL-STA-0237 registered new internet domains associated with a July 2024 MiroTalk fake job campaign.
The group exploited information from a US-based IT services company and controlled multiple IT infrastructure and management accounts that belonged to the company.
A persona linked to the group listed the company as its employer, citing employment since 2019 in some of its fake resumes. It also managed email accounts that mimicked the company’s owner, using them to apply for other jobs.
No tags.
