DPRK Hunting

Threat hunts for the DPRK remote IT-worker scheme and the "Contagious Interview" fake-recruiter campaign. Each hunt states what it detects, lists the indicators it matches on, and carries copy-paste queries.

A query marked as reproduced is as the cited source wrote it; one marked as written for this site was composed against reported indicators. None is a vendor-supported detection.

Hunt library

• TTP Hunt high IP-KVM Hardware on a Corporate Laptop and on Its Network Segment USB and PnP telemetry for the KVM-over-IP and video-capture hardware DPRK operators attach to employer-issued laptops, paired with the network view of the same devices: Raspberry Pi hardware addresses, the default TinyPilot host name and internet-exposed KVM interfaces. WindowsmacOSNetwork Cortex XQL · CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Shodan / Censys · Sigma · Splunk SPL · osquery
• TTP Hunt high IP-KVM Hardware Hiding Behind Spoofed USB Descriptors Catches an IP-KVM whose vendor, product and serial strings have been renamed to something innocuous, using the USB configuration descriptor and interface shape the device cannot change without ceasing to work. WindowsmacOS Cortex XQL · CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Sigma · Splunk SPL · osquery
• TTP Hunt medium GL.iNet Comet IP-KVM Behind Its Built-In Obfuscation Profiles Fingerprints for the GL.iNet Comet, an IP-KVM whose firmware ships with ready-made presets that impersonate a Logitech, Corsair, Dell or Microsoft peripheral, and for the configuration descriptor, display identity and hardware address those presets leave untouched. WindowsmacOSNetwork Cortex XQL · CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Sigma · Splunk SPL · osquery
• TTP Hunt medium Unmanaged Remote-Access and RMM Tooling on Employee Endpoints A fleet-wide sweep for the consumer remote-access and RMM software DPRK IT workers install to hand control of an employer-issued laptop to an operator overseas, with a per-device product count that flags the hosts running four or more of them. WindowsmacOS Cortex XQL · CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Sigma · Splunk SPL · YARA · osquery
• TTP Hunt medium Visual Studio Code Dev Tunnels Used as Remote Access A developer laptop can be handed to a remote operator with no third-party software at all, using the tunnelling feature built into Visual Studio Code. ReliaQuest ranks it among the tools North Korean operators use most. WindowsmacOSNetwork Cortex XQL · CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Sigma · Splunk SPL · osquery
• TTP Hunt medium Inbound RDP and VNC Listeners on an Employee Endpoint A laptop-farm machine has to accept inbound connections. This looks for an endpoint listening on, or accepting traffic on, remote-desktop and remote-access ports, adapting the port checks published by mattysplo.it. WindowsmacOS Cortex XQL · CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Sigma · Splunk SPL · osquery
• IOC Hunt medium Astrill VPN Egress on Corporate Authentication Astrill VPN is the anonymisation service most consistently associated with DPRK remote-worker fraud. This matches corporate sign-ins against its published exit addresses. Identity / cloudWindowsmacOS CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Sigma · Splunk SPL · osquery
• IOC Hunt medium Egress from ISPs and Proxy Services Reported in DPRK Worker Cases The addresses operators appear on when the VPN is not in the way: Russian TTK ranges around Khabarovsk, China Unicom, and the commercial proxy and hosting services named in recent casework. Identity / cloudNetwork Cortex XQL · CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Splunk SPL
• Behavioral Hunt medium Unrelated Employees Authenticating from One Fixed-Line Address The signature of a laptop farm seen from the identity side: two or more employees who have nothing to do with each other, signing in from the same residential address. Identity / cloud CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Splunk SPL
• Behavioral Hunt medium Laptop Shipping Address and Sign-In Geography Against the Record Joins HR, asset-shipping and identity-provider data to find new hires whose laptop shipped away from their recorded address, or whose first month of sign-ins geolocates away from it, the control Mandiant and the FBI single out. Identity / cloud Defender / Sentinel KQL · Splunk SPL
• Behavioral Hunt medium Concurrent Multi-Geography Sessions on One Identity Impossible-travel and overlapping-session logic aimed at the specific case where a laptop physically sits in one country while the person operating it is in another. Identity / cloud CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Splunk SPL
• IOC Hunt medium VDO.Ninja (OBS.Ninja) Screen Relay and Interview-Support Web Services Browser artifacts of the screen-relay and audio/video test services Huntress recovered from a suspected DPRK worker's laptop, including the vdo.ninja push URL used to stream the host's screen out. WindowsmacOSNetwork Cortex XQL · CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Sigma · Splunk SPL
• TTP Hunt low Virtual Cameras and Video-Call Obfuscation Tooling Software and hardware that lets an arbitrary video feed be presented to Zoom or Teams as a webcam, including real-time face-swap tooling, which is how an operator attends a call as somebody else. WindowsmacOS Cortex XQL · CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Sigma · Splunk SPL · osquery
• TTP Hunt low Anti-Idle and Mouse-Jiggling Tooling on Employee Endpoints Software that keeps a machine awake and an account showing as present, which is what an operator running several jobs at once needs on every laptop they are not currently at. WindowsmacOS Cortex XQL · CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Sigma · Splunk SPL · osquery
• TTP Hunt high SASE and Endpoint Agent Tampering by an Employee Disabling the SASE or endpoint agent is how an operator gets their own traffic out from under inspection. DTEX rates it low-recall but high-precision: it does not happen often, and when it does it means something. WindowsmacOS Cortex XQL · CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Sigma · Splunk SPL
• Behavioral Hunt medium Working-Hour and Session-Length Anomalies for Recent Hires Sustained sign-ins at times that make no sense for where the employee says they live, which is how an operator working several jobs round the clock shows in the identity logs. Excessive working hours is among the highest-rated indicators in DTEX's own casework. Identity / cloud CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Splunk SPL
• Behavioral Hunt low Plaintext Credential Notes on Employee Endpoints Text files full of passwords in the obvious folders, which DTEX records in DPRK IT-worker casework as an operator's way of keeping credentials for several employers within reach. WindowsmacOS Cortex XQL · Defender / Sentinel KQL · Elastic · Sigma · Splunk SPL · osquery
• Behavioral Hunt low Company Source Code Pushed to Personal Repositories from an Employee Endpoint Git pushes, remote changes and mirror clones aimed at accounts outside the organisation on public hosting services: the precursor to the data-extortion the FBI now attributes to discovered DPRK IT workers. WindowsmacOS Cortex XQL · CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Sigma · Splunk SPL
• IOC Hunt low Fabricated Candidate Personas and Portfolio-Site Infrastructure A recruiting-side hunt: the free site builders that host fabricated candidate portfolios, the identity-reuse patterns across applications, and the profile tells that repeat across personas. WindowsmacOSNetwork Cortex XQL · CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Sigma · Splunk SPL
• Behavioral Hunt low Identity Reuse and Payroll-Fraud Indicators Shared bank details across employees who should have nothing in common, plus rapid post-hire direct-deposit changes, corroborated against sign-in geography. Identity / cloud Defender / Sentinel KQL · Splunk SPL
• IOC Hunt low Account-Verification and Browser OTP Services on Corporate Assets The services an operation uses to phone-verify accounts in bulk, hold VoIP numbers for personas, and generate multi-factor codes in a browser so a whole team can share one second factor. WindowsmacOSNetwork Cortex XQL · CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Sigma · Splunk SPL
• TTP Hunt medium Persona-Management Tooling on an Employee Endpoint The tools an operation uses to keep many personas apart and to pass identity checks without a real phone or camera, anti-detect browsers, Android emulators and cookie-import tools among them, found on a machine that belongs to one supposed employee. WindowsmacOS Cortex XQL · CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Sigma · Splunk SPL · osquery
• TTP Hunt medium Contagious Interview Fake-Recruiter and Front-Company Infrastructure Catches the interview lure itself: a candidate's workstation cloning and running an unvetted take-home repository, and traffic toward the front companies DPRK operators register to look like employers. WindowsmacOSNetwork Cortex XQL · CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Sigma · Splunk SPL
• TTP Hunt medium ClickFake Interview: ClickFix Execution and GolangGhost Persistence Site The lure where a fake interview site claims the candidate's camera driver is broken and has them paste a command into Run or Terminal, delivering GolangGhost or FrostyFerret. WindowsmacOSNetwork Cortex XQL · CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Sigma · Splunk SPL · osquery
• TTP Hunt medium macOS Persistence and Staging Paths Used by Contagious Interview Payloads The launch agents, /var/tmp staging files, fake installer packages and abused developer signature that Contagious Interview's macOS payloads leave on a developer's Mac, from the FlexibleFerret, GolangGhost and BeaverTail installer lures. macOSNetwork Cortex XQL · CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Sigma · Splunk SPL · osquery
• TTP Hunt high BeaverTail to InvisibleFerret: The Contagious Interview Malware Chain The JavaScript stealer Contagious Interview delivers and the Python backdoor it installs, hunted as one chain: hidden .pyp, .npl and .n2 paths, the /pdown C2 layout, ports 1224, 3000 and 3306, silent AnyDesk and Telegram exfiltration. WindowsmacOS Cortex XQL · CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Sigma · Splunk SPL · YARA · osquery
• IOC Hunt medium Fake MiroTalk Installer in a Recruiter Lure: Qt BeaverTail A MiroTalk.msi or MiroTalk.dmg installer a job candidate is asked to run for a video interview, carrying the Qt-compiled BeaverTail Unit 42 documents, followed by the downloader fetching Python and InvisibleFerret from its controller on TCP 1224. WindowsmacOS Cortex XQL · CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Sigma · Splunk SPL · osquery
• TTP Hunt medium EtherHiding: JADESNOW Loader Pulling Payloads from Public Blockchains A script interpreter on a developer's machine reading blockchain explorer APIs to pull a smart-contract payload, then beaconing on TCP 3306: the on-chain loader Google Threat Intelligence Group attributes to UNC5342, the group behind Contagious Interview. WindowsmacOS Cortex XQL · CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Sigma · Splunk SPL · YARA · osquery
• TTP Hunt low EtherHiding: Fake Google Drive Offline Extension Configured On-Chain A Chrome extension named Google Drive Offline, added silently by a Node.js backdoor after a fake macOS update lure and configured from an Ethereum contract; the chain AllSecure links to UNC5342, as reported by Cyber Security News. macOS Cortex XQL · CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Sigma · Splunk SPL · YARA · osquery
• TTP Hunt medium OtterCookie Modular JavaScript Implant Command-and-control addresses, URI paths and on-disk keylog and screenshot artifacts for the four-module OtterCookie implant Talos analysed alongside BeaverTail. WindowsmacOSLinux Cortex XQL · CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Sigma · Splunk SPL · osquery
• TTP Hunt medium DeceptiveDevelopment Second-Stage Tooling: TsunamiKit, Tropidoor and AkdoorTea The .NET spyware-and-miner kit, the two Windows RATs and the infrastructure ESET documents behind the BeaverTail and InvisibleFerret first stages, including a Tor command channel, coin miners and Defender exclusions. WindowsmacOSLinux Cortex XQL · CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Sigma · Splunk SPL · YARA · osquery
• TTP Hunt medium Suspicious Package Install During an Interview Take-Home Assignment npm, node, pip or python spawning a shell, downloader or the other interpreter just after an install, and the interpreter reaching a staging host minutes later, whether the payload runs in a child process or entirely in memory. WindowsmacOSLinux Cortex XQL · CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Sigma · Splunk SPL · osquery
• TTP Hunt medium PolinRider: Config-File Injection and Git History Rewrite A build-tool config file such as postcss.config.mjs growing an obfuscated tail, a .vscode/tasks.json that runs on folder open, and scripts that amend and force-push the last commit under its original timestamp: the PolinRider campaign. WindowsmacOSLinux Cortex XQL · CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Sigma · Splunk SPL · YARA · osquery
• TTP Hunt medium NullReceiver: C2 Address Read from a Zero-Value Ethereum Transfer A node process calling public Ethereum JSON-RPC endpoints to read an attacker wallet's latest transfer, whose recipient address encodes the next command server, then connecting to it: the NullReceiver technique OpenSourceMalware and Sonatype document. WindowsmacOSLinux Cortex XQL · CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Sigma · Splunk SPL · YARA · osquery
• IOC Hunt high Compromised Legitimate npm Release: axios 1.14.1 and 0.30.4 A routine dependency bump that resolved to axios 1.14.1 or 0.30.4, whose added dependency plain-crypto-js dropped a cross-platform remote-access tool from sfrclak.com:8000, as OpenSourceMalware documents and reports Google and Microsoft attributing to a North Korea-nexus actor. WindowsmacOSLinux Cortex XQL · CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Sigma · Splunk SPL · YARA · osquery
• IOC Hunt medium NetKey and OConnect: DPRK Internal-Network Clients on an Endpoint Process names, install paths and vendor directories for NetKey and OConnect, which Flare assesses are used to authenticate to North Korean internal networks, with the internal URL paths that accompany them. Windows Cortex XQL · CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Sigma · Splunk SPL · osquery
• IOC Hunt medium logs-bin and logs-dump: Republished Keylogger Packages on npm Two npm packages published by one maintainer that republish the node-global-key-listener library under new names, one of them carrying a Windows binary thirty-two times the size of the legitimate one it replaces. WindowsmacOSLinux Cortex XQL · CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Sigma · Splunk SPL · YARA · osquery
• IOC Hunt medium OtterCookie C2 by Its Three-Port Fingerprint The current OtterCookie variant splits its traffic across three ports on one host, 8085, 8086 and 8087, behind an Express server, which makes its command-and-control servers findable in internet scan data before any sample points at them. WindowsmacOSLinuxNetwork Cortex XQL · CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Shodan / Censys · Sigma · Splunk SPL · osquery

No hunt matches that search and filter combination.