kmsec.uk · Published 1 May
North Korea's abuse of Cloudflare Workers and Pages
By kmsec-uk
Excerpt
I took a break from my DPRK tracking hobby to amass a useless collection of public Google Docs in dochunt. But play time is over! DPRK gave me something fun to come back to. Thank you NK, very cool!
Summary
A cluster of 5 npm packages abuse Cloudflare infrastructure (Pages/Workers) to deliver PylangGhost RAT Novel obfuscation techniques, encryption, runtime logic gates, and device fingerprinting are used to hinder detection
This cluster showcases the latest techniques by FAMOUS CHOLLIMA to evade detection and strengthens attribution of Contagious Trader to FAMOUS CHOLLIMA
Before we begin, I should note that this isn’t the first instance of FAMOUS CHOLLIMA abu…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by kmsec.uk on kmsec.uk.