DeceptiveDevelopment targets freelance developers
ID: d5bcea1a-fc6a-5aaf-b87e-49dc230b4c80
STIX ID: report--d5bcea1a-fc6a-5aaf-b87e-49dc230b4c80
Feed Name: WeLiveSecurity (ESET Research)
ESET Research details the DeceptiveDevelopment campaign — a North Korea-aligned operation that lures freelance developers via fake recruiter job challenges and trojanized projects to install BeaverTail (infostealer/downloader) and InvisibleFerret (Python-based infostealer/RAT). The report includes victimology across Windows, Linux, and macOS, technical analysis of the malware and C2 infrastructure, IoCs (hashes, IPs, hosting providers), observed TTPs, and recommendations for identifying and mitigating this cryptocurrency-focused credential-theft campaign.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.