GoKawiilThe infamous phony job-offer ploy by North Korean threat actors is evolving into a self-propagating machine that uses compromised developer projects to infect other code repositories and spread like wildfire through the software supply chain.
The so-called "Contagious Interview" gambit that has been tracked for several years has now firmly moved beyond single-target social engineering attacks aimed at compromising organizations via the developer ecosystem: it is now a significant supply chain threat where a compromised developer's repository itself becomes a worm-like infection vector to spread remote access Trojans (RATs) and other malware, according to a report published this week by Trend Micro.
The latest manifestation of the campaign is by a North Korean actor tracked by Trend Micro as Void Dokkaebi, aka Famous Chollima, which uses fake job lures that target developers with "cryptocurrency wallet credentials, signing keys, and access to continuous integration/continuous delivery (CI/CD) pipelines and production infrastructure," Trend Micro senior threat researcher Lucas Silva wrote in the report.
Related:Exploits Turn Windows Defender Into Attacker Tool
Attackers use malicious Visual Studio (VS) Code tasks and injected code that can execute during normal development activity to spread malware through the software supply chain as well as steal credentials to crypto wallets and other secrets, according to the report. "When that compromised code reaches organizational or popular open-source repositories, contributors, forks, and downstream projects can also be exposed," he wrote.
Moreover, the campaign uses blockchain infrastructure for payload staging — including Tron, Aptos, and Binance Smart Chain — which puts parts of its delivery infrastructure beyond traditional security takedowns, he said.
Latest Wave of Infections
Void Dokkaebi systematically targets software developers by posing as recruiters from cryptocurrency and AI firms to lure developers into cloning and executing code repositories as part of a testing process during fake job interviews, according to Trend Micro.
These ongoing campaigns abuse the trust that developers have in the common practice used by organizations to submit prospective candidates to a technical test during a job interview, Joshua Allman, staff tactical response analyst at security firm Huntress, tells Dark Reading.
"Because they are targeting people looking for work, the attackers are likely to have a more engaged target and they can be incredibly precise with who they target," he says. This can lead to a downstream impact of thousands if they are successful at compromising a popular package/project, Allman observes.
... continue reading