Ankura CTIX FLASH Update - September 10, 2024

Ransomware/Malware Activity

Lazarus Group Continues Campaign Against Developers and IT Professionals

Researchers at Group-IB have recently released a new report on ongoing and new threats posed by Lazarus Group's financially-motivated campaign against job seekers. CTIX analysts discussed the emergence of this campaign in our April 30, 2024 flash. Since then, Lazarus has expanded its capabilities and has introduced new malware targeted at MacOS to steal information and cryptocurrency from job seekers in the IT and Software Development fields. The campaign is rooted in a fictitious job posting and interview process that tricks seekers into downloading a "Node.js" project containing malware. Researchers have observed updated versions of the major forms of malware used in this campaign dubbed BeaverTail and InvisibleFerret. BeaverTail is a JavaScript or Python-based InfoStealer with the ability to steal credentials stored in browsers and vaults as well as data from