DPRK-Linked Contagious Interview Campaign Uses Fake Developer Interviews to Deliver a Backdoor
Summary
Kudelski researchers describe how DPRK-linked operators use fake developer interviews and a trojanized GitHub project to install a backdoor that collects system data, exposes environment secrets, and enables remote commands.
Key points
- Operators reportedly pose as recruiters on LinkedIn, WhatsApp, and Discord, steering developers toward fake coding interviews and malicious project files.
- Researchers say collaborators’ identities and devices were also used to access CodeMentor (codementor[.]io) and apply for freelance roles.
- A trojanized project impersonating Swiss blockchain company Ajuna Network can trigger its backdoor through npm install or a hidden VS Code task.
- The backdoor collects hostname, operating-system details, MAC address, and process environment variables, which may expose API keys, tokens, and other secrets.
- It reportedly beacons to a command-and-control server every five seconds and can execute commands received from the server.
- Researchers describe use of VPSs, residential proxies, and VPNs, including Astrill, and provide Suricata and YARA detection logic.
- The researchers recommend raising employee awareness about fake interviews and using network detection rules; they note that some observations and attribution have limited confidence.
Article Details
- Attack Vectors
- Operators posed as recruiters on LinkedIn, WhatsApp, and Discord, then persuaded developers to run malicious code during fake technical interviews.
- A trojanized GitHub repository impersonating Ajuna-network triggered a backdoor through an npm install prepare step or a hidden .vscode/tasks.json task when the project was opened in VS Code.
- The backdoor gathered host and operating-system information, including the kernel version and platform, and sent the information and process environment to its C2 as URL parameters.
- The backdoor beaconed to its C2 every five seconds and evaluated commands returned in the C2 response.
- The researchers observed Nircmd being used to run .bat files with hidden execution during interviews; they could not inspect those files' contents.
- Defensive Notes
- The researchers recommend using Suricata rules over raw network logs to detect activity associated with the campaign.
- The article provides YARA rules for detecting download-and-execute behavior involving wget or curl and malicious VS Code tasks, and for detecting Nircmd hidden execution of script or batch files.
- Raise employee awareness about fake interviews and requests to install project dependencies or open unfamiliar projects in VS Code.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| URL | hxxp[:]//138[.]201[.]128[.]169:1224/api/checkStatus | C2 endpoint decoded from the backdoor; the article reports that the implant communicates with this endpoint. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe repository concealed obfuscated malicious code after 721 spaces in routes/api/auth.js; the article also describes a custom base64 decoder.T1041 · Exfiltration Over C2 ChannelThe backdoor sends collected system data and process environment values to its C2.T1059.001 · PowerShellThe hidden VS Code task runs PowerShell commands to download and execute the backdoor.T1059.007 · JavaScriptThe trojanized repository launches a Node server through the npm prepare step, and its backdoor executes commands using eval().T1071.001 · Web ProtocolsThe backdoor communicates with its C2 using HTTP requests to an /api/ endpoint.T1082 · System Information DiscoveryThe backdoor gathers the hostname, operating system, kernel version, and platform.T1105 · Ingress Tool TransferThe article describes wget or curl downloading the backdoor from an /api/ endpoint before piping it to a shell.T1204.002 · Malicious FileInterviewees were persuaded to run project installation commands or open a project in VS Code, triggering the backdoor.
Products
GitHubThis article explains how they operate and includes a backdoor analysis of a GitHub repository used in their fake interview workflow.Node.jsvscode folder in “C:\Users\%USERNAME%\”, install node.js, pull and execute “env.npl” which is the exact same backdoor that we analyzed on “routes/api/auth.js”.VS Codeinstall. If the candidate did not want to do it, the interviewer would ask them to open the project in VS Code. That action would trigger the backdoor due to the env task located in .vscode/tasks.json.
Tools
NircmdWe can note that they mainly used three flags related to Nircmd: exec, win, and hide.SuricataIf you are targeted by DPRK-related actors, we recommend that organizations use Suricata rules over raw network logs, as North Korean campaigns often reuse the same techniques and malware.YARAI use Yara here because this is simpler to document and I just want to show the logic of the rule.
Countries
Chinaa DPRK-linked cluster of individuals running the “Contagious Interview” campaign, operating from DPRK and China. Posing as recruiters on LinkedIn, WhatsApp, and Discord, the operators lure job-seeking developers intoDPRKKudelski Security’s research team tracked a DPRK-linked cluster of individuals running the “Contagious Interview” campaign, operating from DPRK and China. Posing as recruiters on LinkedIn, WhatsApp, and Discord, theIranOver time, we observed that DPRK actors ran a scamming scheme by hiring external collaborators in Iran to act as interviewers. They mainly used VPS, residential proxies, and VPNs located in the region they wereJapanFor example, when they targeted Japan, they mainly connected through M247 Japanese ranges, connected to a VPS, or used an Astrill VPN node with a Japanese IP address.SwitzerlandAs we apply a specific marker to threats against Switzerland, we observed that a GitHub repository named Ajuna-solution impersonated a Swiss company named Ajuna-network to likely spread malware and compromise