cyber.hendryadrian.com
Threat Research · trendmicro.com

Void Dokkaebi Uses Cython-Compiled InvisibleFerret to Evade Script-Based Detection

· Original article ↗

Summary

Void Dokkaebi has shifted InvisibleFerret to Cython-compiled Windows and macOS modules, complicating script-based detection. The malware retains credential- and wallet-stealing capabilities, while binary artifacts and runtime scripts can aid analysis.

Key points

  • InvisibleFerret is now distributed as .pyd modules on Windows and .so modules on macOS, loaded through Python execution scripts.
  • The Cython compilation makes the malware harder to detect with rules focused on readable Python scripts; runtime scripts may also supply C2 details absent from binaries.
  • InvisibleFerret retains backdoor, browser credential theft, clipboard monitoring, keylogging, and cryptocurrency wallet-targeting capabilities.
  • BeaverTail has expanded into multiple variants with overlapping backdoor, information-stealing, downloader, and trojanized wallet-extension functions.
  • The macOS wallet module downgrades Chrome to support Manifest V2 extensions and targets MetaMask, Coinbase Wallet, and Phantom.
  • Analysts can recover clues from binaries, including programming artifacts, build paths, compressed strings, and embedded payloads; the underlying deobfuscation logic resembles earlier versions.
  • Trend Micro assesses that the Cython migration is still incomplete and provides hunting queries and indicators to help defenders identify the malware.

Article Details

Attack Vectors
  • The initial attack vector in this campaign is unconfirmed. Historically, Void Dokkaebi has posed as recruiters and lured software developers into cloning and executing code repositories during fabricated job interviews.
  • BeaverTail (gjs) downloads Cython-compiled InvisibleFerret modules and launches them through generated Python execution scripts.
  • BeaverTail (cjs) installs trojanized cryptocurrency wallet browser extensions; the macOS variant downgrades Chrome to support extensions that rely on Manifest V2.
Defensive Notes
  • Use binary-aware detection for Cython-compiled .pyd and .so modules rather than relying only on Python-script detection.
  • Analyze the accompanying Python execution script when investigating C2 destinations, since runtime arguments can override IP addresses and ports embedded in the binary.
  • Inspect compiled binaries for recoverable programming artifacts, build paths, and compressed string tables.
  • Hunt for the article’s listed module and execution-script file paths in the supplied TrendAI Vision One XDR queries.

Indicators of compromise

TypeIndicatorContext
IPV445[.]59[.]160[.]199C2 IP address recovered from the XOR-encoded string table in an InvisibleFerret binary.

MITRE ATT&CK

T1027 · Obfuscated Files or InformationThe malware uses Cython compilation and layered string obfuscation, including Base64, XOR, and Zlib, to conceal code and data.T1056.001 · KeyloggingThe InvisibleFerret pay variant includes keylogging capability on Windows.T1059 · Command and Scripting InterpreterBeaverTail writes a Python execution script and invokes the Python interpreter to load and execute InvisibleFerret modules.T1070.004 · File DeletionThe mc.so variant deletes its execution Python script after use.T1082 · System Information DiscoveryBeaverTail and InvisibleFerret collect system and network information.T1115 · Clipboard DataThe InvisibleFerret pay variant monitors clipboard data.T1555.003 · Credentials from Web BrowsersBeaverTail and InvisibleFerret variants steal credentials and other authentication information stored in browsers.

People

Kazuki FujisawaNamed as the author of the analysis.

Threat Actors

Famous ChollimaThe article identifies Famous Chollima as an alternate name for Void Dokkaebi.Void DokkaebiNorth Korea-aligned intrusion set attributed this campaign with high confidence; the article identifies Famous Chollima as an alternate name.

Malware

BeaverTailBeaverTail has also expanded beyond its original downloader and stealer role into a broader malware with overlapping functions, including credential harvesting and wallet trojanization.InvisibleFerretAnalyzing Void Dokkaebi’s Cython-Compiled InvisibleFerret Malware

Products

AnyDeskIn this infection chain, any variants of InvisibleFerret used to download and configure the AnyDesk execution environment appear to be in the midst of a transition to Cython.Brave BrowserDownloads and installs trojanized browser extensions in Chrome and Brave Browser, including wallet-related extensions, such as MetaMask, Coinbase Wallet, and PhantomCoinbase WalletDownloads and installs trojanized browser extensions in Chrome and Brave Browser, including wallet-related extensions, such as MetaMask, Coinbase Wallet, and PhantomGoogle ChromeDownloads and installs trojanized browser extensions in Chrome and Brave Browser, including wallet-related extensions, such as MetaMask, Coinbase Wallet, and PhantomMetaMaskDownloads and installs trojanized browser extensions in Chrome and Brave Browser, including wallet-related extensions, such as MetaMask, Coinbase Wallet, and PhantomPhantomDownloads and installs trojanized browser extensions in Chrome and Brave Browser, including wallet-related extensions, such as MetaMask, Coinbase Wallet, and Phantom

Tools

CythonAnalyzing Void Dokkaebi’s Cython-Compiled InvisibleFerret Malware

Countries

North KoreaVoid Dokkaebi, a North Korea-aligned intrusion set, has updated its information-stealing malware, InvisibleFerret, shifting its delivery format to evade script-based detections.

Industries

Cryptocurrencyincluding backdoor access, browser credential theft, clipboard monitoring, keylogging, and cryptocurrency wallet targeting.SoftwareThe campaign remains especially relevant to software developers, cryptocurrency users, and organizations whose developers have access to wallet credentials, signing keys, CI/CD pipelines, or production systems.

Related Articles