PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024

BeaverTail has exfiltrated data collected from local systems.

BeaverTail has obfuscated strings of code with Base64 encoding within the JavaScript version of the malware. BeaverTail has also utilized the open-source tool JavaScript-Obfuscator to obfuscate strings and functions.

BeaverTail has masqueraded as MiroTalk installation packages: “MiroTalk.dmg” for macOS and “MiroTalk.msi” for Windows, and has included login GUIs with MiroTalk themes.

Contagious Interview has delivered BeaverTail malware masquerading as legitimate software or applications. Contagious Interview has also delivered malicious payloads masquerading as legitimate software drivers.

BeaverTail has exfiltrated data collected from victim devices to C2 servers.

Contagious Interview has exfiltrated data from a compromised host to actor-controlled C2 servers.

Contagious Interview has exfiltrated victim information using FTP.

BeaverTail has executed malicious JavaScript code. BeaverTail has also been compiled with the Qt framework to execute in both Windows and macOS.

InvisibleFerret has identified specific directories and files for exfiltration using the `ssh_upload` command which contains subcommands of `.sdira`, `sdir`, `sfile`, `sfinda`, `sfindr`, `sfind`. InvisibleFerret also has the capability to scan and upload files of interest from multiple OS systems through the use of scripts that check file names, file extensions, and avoids certain path names. InvisibleFerret has utilized the `findstr` on Windows or the macOS `find` commands to search for files of interest.

BeaverTail has been used to download a malicious payload to include Python based malware InvisibleFerret.

BeaverTail has been hosted on code repositories and disseminated to victims through NPM packages.

BeaverTail has been executed through lures involving malicious JavaScript projects or trojanized remote conferencing software such as MicroTalk or FreeConference. BeaverTail has also been executed through macOS and Windows installers disguised as chat applications.

BeaverTail has searched the victim device for browser extensions including those commonly associated with cryptocurrency wallets.

Contagious Interview has downloaded remote management and monitoring software such as “AnyDesk” for post compromise activities.

BeaverTail has stolen passwords saved in web browsers. BeaverTail has also been known to collect login data from Firefox within key3.db, key4.db and logins.json from `/.mozilla/firefox/` for exfiltration.

BeaverTail has communicated with C2 IP addresses over ports 1224 or 1244.

Contagious Interview has registered domains to leverage in their social engineering campaigns. Contagious Interview has also registered domains to utilize for C2.

Contagious Interview has created fake social media accounts such as LinkedIn and Telegram accounts for their targeting efforts.

Contagious Interview has created fake email accounts to correspond with social media accounts, fake LinkedIn personas, code repository accounts, and job announcements on development job board services. Contagious Interview has also utilized fake email accounts with Threat Intelligence vendor services.

Contagious Interview has developed malware that utilizes Qt cross-platform framework to include BeaverTail.

Contagious Interview has used remote management and monitoring software such as “AnyDesk”.

Contagious Interview has researched specific professional groups such as software developers for targeting. Contagious Interview has also researched individuals who work in roles related to cryptocurrency and blockchain technologies.

Contagious Interview had identified and solicited victims through social media such as LinkedIn, X, and Telegram.

Contagious Interview has stolen cryptocurrency wallet credentials and credit card information utilizing BeaverTail and InvisibleFerret malware.

BeaverTail has searched the victim device for browser extensions commonly associated with cryptocurrency wallets.

Contagious Interview has used AI to clone video-conferencing applications to distribute their BeaverTail malware. They have also used AI to create deepfake videos.

Contagious Interview had impersonated HR hiring personnel through social media, job board notifications, and conducted interviews with victims in order to entice them to download malware disguised as legitimate applications or malicious scripts from code repositories.