New North Korean campaign uses fake coding interviews to steal developer credentials

MITRE Techniques

• [T1056.001 ] Keylogging / Clipboard Data Capture – The campaign included clipboard stealing to collect copied content from victim systems. [‘The clipboard functionality is only available on macOS and Windows. The malware polls every 500ms for new clipboard content, exfiltrating any changes’]
• [T1105 ] Ingress Tool Transfer – The dropper downloaded second-stage binaries from an external host before renaming them and executing them. [‘downloads three second-stage binaries via curl from file.rightwidth[.]dev’]
• [T1027 ] Obfuscated Files or Information – The malware used obfuscator.io and hidden Base64 fragments in SVG comments to conceal payloads and evade static detection. [‘hide chunks of the malware’, ‘This JavaScript malware is protected by obfuscator.io’]
• [T1027.003 ] Steganography – Malware code was concealed inside legitimate-looking SVG image files. [‘using steganography in SVG image files to hide chunks of the malware’]
• [T1036 ] Masquerading – The malware disguised itself as benign npm-related activity and legitimate project files to avoid suspicion. [‘sets its process title to npm-cache, masquerading as a benign npm caching process’]
• [T1059.007 ] JavaScript – The malicious logic was implemented in JavaScript and executed on server startup. [‘server/index.js calls runServerValidation()’, ‘JavaScript file in the repo’]
• [T1218.005 ] Scripting: Visual Basic / PowerShell – PowerShell was used on Windows to read clipboard contents. [‘powershell -NoProfile -NonInteractive Get-Clipboard’]
• [T1053 ] Scheduled Task / Job – The malware ran persistently on startup by being invoked through npm scripts when the server launched. [‘both npm run dev and npm start launch server/index.js, so the payload executes on each server boot’]
• [T1071.001 ] Web Protocols – The RAT used Socket.IO over HTTPS for command-and-control communication. [‘establishes a persistent Socket.IO command-and-control channel’]
• [T1021.005 ] Remote Services: Socket Sessions – The operator executed shell commands over the Socket.IO channel for interactive access. [‘returns the output as a message event over the same Socket.IO connection’]
• [T1082 ] System Information Discovery – The malware collected host details and checked system characteristics for VM detection and victim registration. [‘system host information’, ‘Retrieves system details using the WMIC command’]
• [T1497.001 ] Virtualization/Sandbox Evasion: System Checks – The malware checked for VMware, VirtualBox, QEMU, Parallels, and similar indicators before continuing. [‘vmware, virtualbox, qemu, microsoft corporation’, ‘If there is a match, the malware places a tag in the C2 response with (VM)’]
• [T1113 ] Screen Capture / Clipboard Theft – The malware collected clipboard content as a form of user input theft. [‘exfiltrating any changes to the C2 server’]
• [T1003 ] OS Credential Dumping – The browser credential and keychain theft targeted saved credentials and authentication material. [‘exfiltrates saved credentials’, ‘the system keychain database is also exfiltrated’]
• [T1005 ] Data from Local System – The file stealer recursively collected documents, source code, configuration files, histories, and other local data. [‘searching for the following files whose names match a set of glob patterns’]
• [T1033 ] System Owner/User Discovery – The malware used user and host context in registration and file-path targeting, including user directory lock files. [‘writing its own process ID to a lock file in the user’s directory’]