Ankura CTIX FLASH Update - April 30, 2024

Ransomware/Malware Activity

Job-Seeking Software Developers Deceived into Downloading a Python Backdoor

Researchers are following a social engineering-based malware campaign designed to deceive job-seeking software developers into downloading a malicious python backdoor as part of a fake interview process. The campaign is called "DEV#POPPER" and researchers have speculated that North Korea may be behind its operation. The attackers are known to make initial contact with prospective employees by posing as hiring managers looking to fill a developer role. As part of the interview process, candidates are asked to download a coding task from a GitHub repository, purportedly as a test of technical aptitude. The zip file hosted on GitHub and downloaded by the victim contains an NPM (node package manager) package along with a README.md file. When the NPM package is run, an obfuscated JavaScript file runs a curl command that downloads an archive file which itself is an