Lazarus leveraged a ClickFix social-engineering lure in fake recruitment interviews to trick victims into running a malicious “Nvidia” update that installs BeaverTail and the Python trojan InvisibleFerret across Windows and macOS. The campaign uses bat/vbs/shell installers, Node.js deployment, a Win11-specific backdoor drvUpdate.exe (C2 103.231.75.101:8888), and C2 servers such as 45.159.248.110 to exfiltrate data. #BeaverTail #InvisibleFerret
Keypoints
- Lazarus used ClickFix social-engineering in fake job/interview sites to prompt victims to run a “repair” that downloads malicious Nvidia-branded packages.
- Initial dropper ClickFix-1.bat downloads nvidiaRelease.zip from driverservices.store and executes run.vbs, which branches for Win11 to run drvUpdate.exe.
- Shell.bat installs Node.js if absent, runs npm install/npm start to execute main.js (BeaverTail), and persists via registry autostart to a Python trojan path.
- Main.js (BeaverTail) connects to C2 (hxxp://45.159.248.110) and fetches additional payloads including InvisibleFerret Python malware.
- drvUpdate.exe is a Win11 backdoor communicating with 103.231.75.101:8888, supporting remote cmd execution, file read/write, and system info exfiltration.
- Campaign also targets macOS with arm64-fixer packages and a plist-based persistence running drivfixer.sh which similarly installs Node.js and BeaverTail.
- IOCs include multiple MD5 hashes, malicious domains/URLs, and C2 IPs; attribution to Lazarus is supported by similarity to prior reported commands and payloads.
MITRE Techniques
- [T1204] User Execution – Victims were socially engineered via fake job/interview sites to run a “repair” command that downloaded and executed malicious packages (“…the site prompts the victim that the camera configuration does not meet requirements or has a fault, and gives a fix that downloads a fake Nvidia update…”).
- [T1202] Indirect Command Execution – run.vbs checks OS BuildNumber and Node.js presence then launches shell.bat or drvUpdate.exe to execute subsequent components (“…Run.vbs checks BuildNumber … if Win11 then run drvUpdate.exe … if Node.js exists then run shell.bat…”).
- [T1543] Create or Modify System Process – Persistence via registry and LaunchAgents plist to auto-start malware components (“…establish persistence by adding registry command ‘%USERPROFILE%.pyppythonw.exe’ ‘%USERPROFILE%.n2pay’…”; “…set plist path ‘~/Library/LaunchAgents/com.local.drvierUpdate.plist’…”).
- [T1105] Ingress Tool Transfer – BeaverTail and InvisibleFerret were downloaded from C2 servers to victim systems (“…BeaverTail C2 is hxxp://45.159.248.110. BeaverTail also downloads and deploys Python trojan InvisibleFerret…”).
- [T1059] Command and Scripting Interpreter – Use of bat, vbs, shell scripts, Node.js (npm start running main.js) to execute malicious logic (“…ClickFix-1.bat … run.vbs … shell.bat … npm install and npm start … main.js …”).
- [T1574] Hijack Execution Flow – Installing Node.js and executing npm scripts from attacker-supplied package.json to run main.js BeaverTail (“…download and install Node.js … run npm install and npm start which executes main.js …”).
- [T1071] Application Layer Protocol – Malware communicates with C2 servers over HTTP to download additional payloads and receive commands (“…C2 servers hxxp://45.159.248.110, hxxp://45.89.53.54 … drvUpdate.exe connects to 103.231.75.101:8888 …”).
Indicators of Compromise
- [MD5] Windows dropper and payloads – f9e18687a38e968811b93351e9fca089 (ClickFix-1.bat), a4e58b91531d199f268c5ea02c7bf456 (nvidiaRelease.zip)
- [MD5] BeaverTail and backdoor – b52e105bd040bda6639e958f7d9e3090 (main.js/BeaverTail), 6175efd148a89ca61b6835c77acc7a8d (drvUpdate.exe)
- [MD5] macOS samples – cdf296d7404bd6193514284f021bfa54 (arm64-fixer), cbd183f5e5ed7d295d83e29b62b15431 (arm64-fixernew)
- [Domain] Malicious hosting domains used to serve payloads – driverservices.store (e.g., hxxps://driverservices.store/visiodrive/nvidiaRelease.zip), block-digital.online (e.g., hxxps://block-digital.online/drivers/cam_driver)
- [IP:Port] C2 infrastructure – 45.159.248.110 (BeaverTail C2 hxxp://45.159.248.110), 103.231.75.101:8888 (drvUpdate.exe backdoor C2)
Read more: https://www.ctfiot.com/267223.html