North Korean Hackers Turn JSON Services into Covert Malware Delivery Channels

The Hacker News reports that North Korean threat actors behind the Contagious Interview campaign have updated their tactics by using JSON storage services to stage malicious payloads, including JSON Keeper, JSONsilo and npoint[.]io, to host and deliver malware from trojanized code projects.

According to NVISO, the researchers Bart Parys, Stef Collart, and Efstratios Lontzetidis said in a Thursday report that the campaign targets prospective colleagues on LinkedIn, inviting them to download a demo project hosted on GitHub, GitLab or Bitbucket. In one observed project, a file named server/config/.config[.]env contains a Base64-encoded value that masquerades as an API key but is actually a URL to a JSON storage service where the next-stage payload is kept in an obfuscated form.

The payload is a JavaScript malware named BeaverTail, which can harvest sensitive data and drop a Python backdoor called InvisibleFerret, with TsunamiKit also fetched from Pastebin. ESET had earlier highlighted the use of TsunamiKit as part of Contagious Interview, and the toolkit can perform system fingerprinting, data collection and fetch additional payloads from a hard-coded .onion address.

The researchers warned that the actors appear intent on casting a wide net to exfiltrate data and crypto wallet information while blending in with normal traffic.