Cybersecurity researchers have discovered an up to date variant of a identified stealer malware that attackers affiliated with the Democratic Individuals’s Republic of Korea (DPRK) have delivered as a part of prior cyber espionage campaigns focusing on job seekers.
The artifact in query is an Apple macOS disk picture (DMG) file named “MiroTalk.dmg” that mimics the legitimate video call service of the identical identify, however, in actuality, serves as a conduit to ship a local model of BeaverTail, safety researcher Patrick Wardle said.
BeaverTail refers to a JavaScript stealer malware that was first documented by Palo Alto Networks Unit 42 in November 2023 as a part of a marketing campaign dubbed Contagious Interview that goals to contaminate software program builders with malware via a supposed job interview course of. Securonix is monitoring the identical exercise beneath the moniker DEV#POPPER.
Apart from siphoning delicate data from internet browsers and crypto wallets, the malware is able to delivering extra payloads like InvisibleFerret, a Python backdoor that is accountable for downloading AnyDesk for persistent distant entry.
Whereas BeaverTail has been distributed by way of bogus npm packages hosted on GitHub and the npm bundle registry, the most recent findings mark a shift within the distribution vector.
“If I needed to guess, the DPRK hackers possible approached their potential victims, requesting that they be a part of a hiring assembly, by downloading and executing the (contaminated model of) MiroTalk hosted on mirotalk[.]internet,” Wardle stated.
An evaluation of the unsigned DMG file reveals that it facilitates the theft of information from internet browsers like Google Chrome, Courageous, and Opera, cryptocurrency wallets, and iCloud Keychain. Moreover, it is designed to obtain and execute extra Python scripts from a distant server (i.e., InvisibleFerret).
“The North Korean hackers are a wily bunch and are fairly adept at hacking macOS targets, though their approach usually depend on social engineering (and thus from a technical viewpoint are slightly unimpressive),” Wardle stated.
The disclosure comes as Phylum uncovered a brand new malicious npm bundle named call-blockflow that is just about similar to the reliable call-bind however incorporates complicated performance to obtain a distant binary file whereas taking painstaking efforts to fly beneath the radar.
“On this assault, whereas the call-bind bundle has not been compromised, the weaponized call-blockflow bundle copies all of the belief and legitimacy of the unique to bolster the assault’s success,” it stated in a press release shared with The Hacker Information.
The bundle, suspected to be the work of the North Korea-linked Lazarus Group and unpublished about an hour and a half later after it was uploaded to npm, attracted a complete of 18 downloads. Proof means that the exercise, comprising over three dozen malicious packages, has been underway in waves since September 2023.
“These packages, as soon as put in, would obtain a distant file, decrypt it, execute an exported operate from it, after which meticulously cowl their tracks by deleting and renaming recordsdata,” the software program provide chain safety firm said. “This left the bundle listing in a seemingly benign state after set up.”
It additionally follows an advisory from JPCERT/CC, warning of cyber assaults orchestrated by the North Korean Kimsuky actor focusing on Japanese organizations.
The an infection course of begins with phishing messages impersonating safety and diplomatic organizations, and comprise a malicious executable that, upon opening, results in the obtain of a Visible Primary Script (VBS), which, in flip, retrieves a PowerShell script to reap consumer account, system and community data in addition to enumerate recordsdata and processes.
The collected data is then exfiltrated to a command-and-control (C2) server, which responds again with a second VBS file that is then executed to fetch and run a PowerShell-based keylogger named InfoKey.
“Though there have been few reviews of assault actions by Kimsuky focusing on organizations in Japan, there’s a risk that Japan can also be being actively focused,” JPCERT/CC said.
