Comic Sans and Cybercrime: Inside North Korea’s Global Cyber Playbook

Podcast Episode · DISCARDED: Tales From the Threat Research Trenches · 07/01/2025 · 53m

Apple Podcasts
"Another Wave: North Korean Contagious Interview Campaign Drops 35 New Malicious npm Packages" published by Socket. #BeaverTail, #ContagiousInterview, #HexEval, #NPM, #DPRK, #CTI https://socket.dev/blog/north-korean-contagious-interview-campaign-drops-35-new-malicious-npm-packages
"These North Korean phishers just don't stop" published by dazhengzhang. #ContagiousInterview, #DPRK, #CTI https://archive.is/LbK6h
"WaterPlumが使用するマルウェアOtterCookieの機能追加" published by NTTSecurity. #OtterCookie, #WaterPlum, #ContagiousInterview, #DPRK, #CTI https://jp.security.ntt/tech_blog/waterplum-ottercookie
WaterPlumが使用するマルウェアOtterCookieの機能追加 | NTTセキュリティテクニカルブログ

{}

NTT Security Holdings
"Additional Features of OtterCookie Malware Used by WaterPlum" published by NTTSecurity. #OtterCookie, #WaterPlum, #ContagiousInterview, #DPRK, #CTI https://jp.security.ntt/tech_blog/en-waterplum-ottercookie
Additional Features of OtterCookie Malware Used by WaterPlum | NTTセキュリティテクニカルブログ

{}

NTT Security Holdings
"Now that the cat is out of the bag regarding the use of front companies like BlockNovas LLC" published by TeamCymru. #ContagiousInterview, #DPRK, #CTI https://archive.is/E2Hcp
Rolling in the Deep(Web): Lazarus Tsunami

The „Contagious Interview“ campaign to steal crypto currencies is still going on. We share our analysis of a comprehensive sample of the Tsunami framework used by the Lazarus group together with Yara rules and IoC to help detecting it.

HiSolutions Research

good thing the US is gutting beneficial ownership regulations that would make it easier to understand who actually owns US trusts and corporations while simultaneously trashing both crypto enforcement at the DOJ but also more generally cyber defense

"The companies, Blocknovas LLC and Softglide LLC, were set up in the states of #NewMexico and New York using fake personas and addresses."

* Reuters: https://www.reuters.com/sustainability/boards-policy-regulation/north-korean-cyber-spies-created-us-firms-dupe-crypto-developers-2025-04-24/
* Technical details from Silent Push: https://www.silentpush.com/blog/contagious-interview-front-companies/

#DPRK #NorthKorea #hackers #crypto #cybersecurity #infosec #uspol #Nypol #newyork #uspolitics #contagiousInterview #Github #lazarusGroup

"Contagious Interview (DPRK) Launches a New Campaign Creating Three Front Companies to Deliver a Trio of Malware" published by Silentpush. #BeaverTail, #ContagiousInterview, #InvisibleFerret, #OtterCookie, #FamousChollima, #ClickFix, #DPRK, #CTI https://www.silentpush.com/blog/contagious-interview-front-companies/
Contagious Interview (DPRK) Launches a New Campaign Creating Three Front Companies to Deliver a Trio of Malware: BeaverTail, InvisibleFerret, and OtterCookie

Contagious Interview (DPRK) have launched a new campaign involving three front companies that deliver BeaverTail, InvisibleFerret, and OtterCookie malware.

Silent Push
"Interview with the Chollima" published by BirminghamCyber. #ContagiousInterview, #OtterCookie, #DPRK, #CTI https://quetzal.bitso.com/p/interview-with-the-chollima
Interview with the Chollima

Lazarus tried to trick us... And we ended up stealing their malware

Bitso Quetzal Team