Abstract:
Law enforcement and cybersecurity researchers have disclosed a massive malicious cyber campaign. A hacker group associated with the North Korean government successfully infected approximately 30,000 devices around the world by masquerading as recruiters and using carefully designed false programming tests, and stole more than $10 million worth of digital assets from more than 7,000 cryptocurrency wallets.
Investigations by cyber security agencies show that the hacker group (tracked by industry code names including WaterPlum and Contagious Interview series) mainly targets software engineers, cryptocurrency developers and technology industry job seekers. Attackers find targets through mainstream social and professional platforms such as LinkedIn, GitHub, Slack, Discord and Telegram, and establish connections with job seekers by forging the identities of well-known and highly credible brands or technical recruiters. After establishing trust, the hacker will move the communication to a private message and ask the candidate to download and run a specific "programming test task" or code library, citing the interview evaluation.
These test projects appear to be fully functional e-commerce templates or open source tools, but there are hidden secrets behind the scenes. Hackers used extremely covert steganography and a multi-stage infection mechanism to hide malicious code segments in image files (such as flag icons in SVG format) or automatic execution configuration files in the project asset directory, thereby bypassing conventional anti-virus software and security monitoring tools. Once the developer runs the project in the local development environment or opens the code folder, the malicious backdoor is silently activated in the background.
The backdoor program implanted in the system has strong secret-stealing capabilities and can scan and extract browser cache passwords, cloud credentials, clipboard contents, and various desktop and browser extension cryptocurrency wallet data. After taking control of the target device, the hacker quickly transfers funds to clear the victim's encrypted wallet, and sends the stolen sensitive files and network access rights to the remote control server. Because many victims ran the test code on their daily office computers, the attack further penetrated into the internal networks of related companies and projects.
Cybersecurity analysts pointed out that in recent years, hacker organizations' methods of using fake recruitment and technical testing to deceive developers have been rapidly evolving, and their code disguise methods and grasp of the psychology of technical personnel have become increasingly precise. Experts remind practitioners in related fields that when participating in offline technical testing or introducing external third-party code libraries, they must run in an isolated virtual machine or sandbox environment, and carefully review the permissions of automated scripts to prevent falling into a job trap.
Comments