North Korea Fake Job Recruiters Up Their Backdoor Game

A gang of North Korean hackers behind fake IT job recruitment scams now have access to a remote access Trojan favored by their more technically advanced counterparts tracked collectively as the Lazarus Group, say security researchers.

See Also: OnDemand | North Korea’s Secret IT Army and How to Combat It

Cybersecurity firm Eset tracks a Pyongyang threat actor known for posing as recruiters and using fraudulent job offers as “DeceptiveDevelopment.” Like Lazarus-linked activity tracked as “Operation Dream Job,” the threat actor posts recruiter profiles in a bid to social engineer developers into downloading malware, but Eset says the two groups are separate.

Cyber defenders first spotted DeceptiveDevelopment activity in 2023. North Koreans posing as recruiters, and also as IT workers, has been an ongoing problem for Western job seekers and employers. The U.S. Department of Justice in June announced coordinated actions in 16 states against North Korean remote IT-worker scams including two indictments, an arrest, searches of 29 laptop farms, seizures of 29 financial accounts and 21 websites (see: US Announces Crackdown on North Koreans Posing as IT Workers).

The DeceptiveDevelopment campaign targets Windows, macOS and Linux operating systems, pushing victims to copy terminal commands during staged “pre-interviews” in a ClickFix trick. Eset telemetry shows ClickFix attacks jumped more than 500% in the first half of this year.

DeceptiveDevelopment operators pose as recruiters on LinkedIn and freelance marketplaces and shepherd candidates to code tests or slick interview sites. After filling out lengthy forms, applicants are told to record a short video. The attacker-controlled site throws a fake camera and microphone error, offering a “How to fix” link. The instructions vary by operating system but lead to the same result: a terminal command that downloads and executes a first-stage payload. Once in, DeceptiveDevelopment typically drops BeaverTail, sometimes its JavaScript evolution, OtterCookie, to steal browser credentials and crypto wallet data and to fetch a second stage dubbed InvisibleFerret, a modular Python backdoor with stealer, payload, clipboard and remote access components.

Researchers said the code in a second-stage payload they call “Tropidoor” overlaps with “PostNapTea,” a backdoor previously tied to the Lazarus Group.

“Tropidoor is the most sophisticated payload yet linked to the DeceptiveDevelopment group, probably because it is based on malware developed by the more technically advanced threat actors under the Lazarus umbrella,” Eset wrote.

Researchers also observed a new Windows remote-access payload they dub “AkdoorTea” inside an archive named nvidiaRelease.zip that was fetched by a script called ClickFix-1.bat, mixing legitimate Nvidia components with a trojanized Node.js installer, an obfuscated BeaverTail script and new command-and-control infrastructure.

DeceptiveDevelopment hackers appear to hand off the information they steal from victims to a related threat actor that Eset dubs “WageMole.” Hackers in that group pose as job seekers.