North Korean operatives spotted using evasive techniques to steal data and cryptocurrency

Cisco Talos and Google Threat Intelligence report that North Korea‑linked operators (Famous Chollima/UNC5342) are conducting social‑engineering campaigns that lure job seekers into installing multi‑stage malware (BeaverTail, OtterCookie, JadeSnow, InvisibleFerret) to exfiltrate credentials and cryptocurrency and to deploy ransomware; researchers observed new functionality including keylogging/screenshot modules and the use of EtherHiding to host decentralized JavaScript C2 on a public blockchain, and both vendors published IoCs to aid detection.