SYMBOLCOMMON_NAMEaka. SYNONYMS
py.invisibleferret (Back to overview)

InvisibleFerret

Actor(s): WageMole

There is no description at this point.

References
2026-05-22 ⋅ Trend Micro ⋅ Kazuki Fujisawa
Analyzing Void Dokkaebi’s Cython-Compiled InvisibleFerret Malware
BeaverTail InvisibleFerret
2026-05-05 ⋅ OpenSourceMalware ⋅ OpenSourceMalware
Lazarus Group Uses Git Hooks To Hide Malware
BeaverTail InvisibleFerret
2026-04-22 ⋅ Expel ⋅ Marcus Hutchins
Inside Lazarus: How North Korea uses AI to industrialize attacks on developers
BeaverTail OtterCookie InvisibleFerret HexagonalRodent
2026-04-21 ⋅ Trend Micro ⋅ Lucas Silva
Void Dokkaebi Uses Fake Job Interview Lure to Spread Malware via Code Repositories
BeaverTail JADESNOW OtterCookie InvisibleFerret
2026-03-11 ⋅ Microsoft ⋅ Microsoft Defender Experts, Microsoft Defender Security Research Team
Contagious Interview: Malware delivered through fake developer job interviews
BeaverTail OtterCookie StoatWaffle InvisibleFerret PylangGhost GolangGhost Contagious Interview
2026-01-20 ⋅ Abstract Security ⋅ Abstract Security Threat Research Organization
Contagious Interview: Tracking the VS Code Tasks Infection Vector
BeaverTail InvisibleFerret
2026-01-13 ⋅ Security Alliance ⋅ Security Alliance
VS Code Tasks Abuse by Contagious Interview (DPRK)
BeaverTail InvisibleFerret
2026-01-11 ⋅ Red Asgard ⋅ Red Asgard
Hunting Lazarus: Inside the Contagious Interview C2 Infrastructure
BeaverTail InvisibleFerret
2025-12-17 ⋅ Recorded Future ⋅ Insikt Group
PurpleBravo’s Targeting of the IT Software Supply Chain
BeaverTail InvisibleFerret PylangGhost GolangGhost
2025-11-28 ⋅ OpenSourceMalware ⋅ OpenSourceMalware
"Contagious Interview" campaign abuses Microsoft VSCode tasks to drop malware and gain persistence
BeaverTail InvisibleFerret
2025-11-13 ⋅ NVISO Labs ⋅ Bart Parys, Efstratios Lontzetidis, Stef Collart
Contagious Interview Actors Now Utilize JSON Storage Services for Malware Delivery
BeaverTail OtterCookie InvisibleFerret Beavertail TsunamiKit
2025-10-20 ⋅ Medium Deriv-Tech ⋅ Shantanu Ghumade
How a fake AI recruiter delivers five staged malware disguised as a dream job
BeaverTail OtterCookie InvisibleFerret
2025-10-16 ⋅ Cisco Talos ⋅ Michael Kelley, Vanja Svajcer
BeaverTail and OtterCookie evolve with a new Javascript module
BeaverTail OtterCookie InvisibleFerret
2025-10-10 ⋅ Socket ⋅ Kirill Boychenko
North Korea’s Contagious Interview Campaign Escalates: 338 Malicious npm Packages, 50,000 Downloads
BeaverTail InvisibleFerret
2025-09-25 ⋅ ESET Research ⋅ Matěj Havránek, Peter Kálnai
DeceptiveDevelopment: From primitive crypto theft to sophisticated AI-based deception
BeaverTail OtterCookie InvisibleFerret PylangGhost AkdoorTea GolangGhost Tropidoor TsunamiKit
2025-09-25 ⋅ Virus Bulletin ⋅ Matěj Havránek, Peter Kálnai
DeceptiveDevelopment: From primitive crypto theft to sophisticated AI-based deception
BeaverTail OtterCookie InvisibleFerret PylangGhost AkdoorTea GolangGhost Tropidoor TsunamiKit
2025-09-17 ⋅ GitLab ⋅ GitLab
Tech Note - BeaverTail variant distributed via malicious repositories and ClickFix lure
BeaverTail OtterCookie BeaverTail InvisibleFerret Beavertail GolangGhost
2025-09-10 ⋅ ANY.RUN ⋅ ANY.RUN
Lazarus Group Attacks in 2025: Here’s Everything SOC Teams Need to Know
OtterCookie InvisibleFerret PylangGhost
2025-08-27 ⋅ Anthropic ⋅ Anthropic
Anthropic - Threat Intelligence Report: August 2025
BeaverTail OtterCookie GolangGhost InvisibleFerret GolangGhost
2025-07-14 ⋅ Socket ⋅ Kirill Boychenko
Contagious Interview Campaign Escalates With 67 Malicious npm Packages and New Malware Loader
BeaverTail InvisibleFerret
2025-06-24 ⋅ Socket ⋅ Socket
Another Wave: North Korean Contagious Interview Campaign Drops 35 New Malicious npm Packages
BeaverTail InvisibleFerret
2025-06-03 ⋅ ANY.RUN ⋅ ANY.RUN
OtterCookie: Analysis of Lazarus Group Malware Targeting Finance and Tech Professionals
BeaverTail OtterCookie InvisibleFerret
2025-05-12 ⋅ ESET Research ⋅ ESET Research
ESET APT Activity Report Q4 2024–Q1 2025
BeaverTail InvisibleFerret GolangGhost
2025-05-07 ⋅ NTT Security ⋅ Masaya Motoda, Rintaro Koike
Additional Features of OtterCookie Malware Used by WaterPlum
BeaverTail OtterCookie InvisibleFerret
2025-04-25 ⋅ HiSolutions ⋅ Maik Würth, Mateo Mrvelj, Nicolas Sprenger
Rolling in the Deep(Web): Lazarus Tsunami
InvisibleFerret tsunami TsunamiKit
2025-04-24 ⋅ Silent Push ⋅ Silent Push
Contagious Interview (DPRK) Launches a New Campaign Creating Three Front Companies to Deliver a Trio of Malware: BeaverTail, InvisibleFerret, and OtterCookie
BeaverTail OtterCookie FrostyFerret GolangGhost InvisibleFerret GolangGhost
2025-04-23 ⋅ Trend Micro ⋅ Feike Hacquebord, Stephen Hilt
Russian Infrastructure Plays Crucial Role in North Korean Cybercrime Operations
BeaverTail FrostyFerret GolangGhost InvisibleFerret GolangGhost WageMole
2025-04-11 ⋅ Bitso Quetzal Team ⋅ Mauro Eldritch
Interview with the Chollima
BeaverTail OtterCookie InvisibleFerret
2025-04-04 ⋅ Socket ⋅ Socket
Lazarus Expands Malicious npm Campaign: 11 New Packages Add Malware Loaders and Bitbucket Payloads
BeaverTail InvisibleFerret
2025-02-20 ⋅ ESET Research ⋅ ESET Research
DeceptiveDevelopment targets freelance developers
BeaverTail InvisibleFerret
2025-02-13 ⋅ Recorded Future ⋅ Recorded Future
Inside the Scam: North Korea’s IT Worker Threat
BeaverTail OtterCookie InvisibleFerret
2025-02-07 ⋅ ⋅ SI-CERT ⋅ SI-CERT
SI-CERT TZ016 / BeaverTail & InvisibleFerret
BeaverTail InvisibleFerret
2025-02-05 ⋅ Bitdefender ⋅ Alina Bizga, Andrei ANTON-AANEI, Ionuț-Alexandru Baltariu
Lazarus Group Targets Organizations with Sophisticated LinkedIn Recruiting Scam
BeaverTail InvisibleFerret tsunami
2025-01-29 ⋅ SecurityScorecard ⋅ SecurityScorecard STRIKE Team
Operation Phantom Circuit: North Korea’s Global Data Exfiltration Campaign
BeaverTail InvisibleFerret
2025-01-29 ⋅ Socket ⋅ Kirill Boychenko, Peter van der Zee
North Korean APT Lazarus Targets Developers with Malicious npm Package
BeaverTail InvisibleFerret
2024-12-24 ⋅ ⋅ NTT Security Holdings ⋅ NTT Security Holdings
Contagious Interview Uses New Malware Otter Cookie
BeaverTail OtterCookie InvisibleFerret
2024-11-26 ⋅ Arxiv ⋅ Alessio Di Santo
Lazarus Group Targets Crypto-Wallets and Financial Data while employing new Tradecrafts
BeaverTail InvisibleFerret tsunami TsunamiKit
2024-11-14 ⋅ eSentire ⋅ eSentire
Bored BeaverTail & InvisibleFerret Yacht Club – A Lazarus Lure Pt.2
BeaverTail InvisibleFerret
2024-11-14 ⋅ Palo Alto ⋅ Unit 42
Fake North Korean IT Worker Linked to BeaverTail Video Conference App Phishing Attack
BeaverTail InvisibleFerret WageMole
2024-11-04 ⋅ Zscaler ⋅ Zscaler
From Pyongyang to Your Payroll: The Rise of North Korean Remote Workers in the West
BeaverTail InvisibleFerret WageMole
2024-10-29 ⋅ SecurityScorecard ⋅ SecurityScorecard STRIKE Team
The Job Offer That Wasn’t: How We Stopped an Espionage Plot
BeaverTail InvisibleFerret
2024-10-29 ⋅ ⋅ Macnica ⋅ Hiroshi Takeuchi
Job Offer from the North: Contagious Interview for Software Developers
BeaverTail InvisibleFerret
2024-10-24 ⋅ Datadog ⋅ Datadog
Tenacious Pungsan: A DPRK threat actor linked to Contagious Interview
BeaverTail InvisibleFerret
2024-10-17 ⋅ Github (ssrdio) ⋅ Gregor Spagnolo
Analysis of BeaverTail & InvisibleFerret activity
BeaverTail InvisibleFerret
2024-09-10 ⋅ Stacklok ⋅ Stacklok
Dependency hijacking: Dissecting North Korea’s new wave of DeFi-themed open source attacks targeting developers
BeaverTail InvisibleFerret
2024-09-04 ⋅ Group-IB ⋅ Sharmine Low
APT Lazarus: Eager Crypto Beavers, Video calls and Games
BeaverTail BeaverTail InvisibleFerret Beavertail
2024-07-15 ⋅ Objective-See ⋅ Patrick Wardle
This Meeting Should Have Been an Email: A DPRK stealer, dubbed BeaverTail, targets users via a trojanized meeting app
BeaverTail BeaverTail InvisibleFerret
2023-11-21 ⋅ Palo Alto Networks Unit 42 ⋅ Unit 42
Hacking Employers and Seeking Employment: Two Job-Related Campaigns Bear Hallmarks of North Korean Threat Actors
BeaverTail InvisibleFerret WageMole

There is no Yara-Signature yet.