Void Dokkaebi (Famous Chollima) Cython-Compiled InvisibleFerret — .pyd/.so Binary Evasion of Script-Based Detections (DPRK Contagious Interview) — Threadlinqs Intelligence
As of 2026-05-30, Void Dokkaebi (Famous Chollima) Cython-Compiled InvisibleFerret — .pyd/.so Binary Evasion of Script-Based Detections (DPRK Contagious Interview) is a high-severity malware threat attributed to WageMole (North Korea), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 29 indicators of compromise.
Threat ID: TL-2026-0567 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: WageMole · North Korea · FINANCIAL
North Korea-aligned intrusion set Void Dokkaebi (aka Famous Chollima, PurpleBravo, Tenacious Pungsan, DEV#POPPER) has migrated its InvisibleFerret information-stealer from readable Python scripts to
Void Dokkaebi (also tracked as Famous Chollima by CrowdStrike, PurpleBravo by Recorded Future, Tenacious Pungsan by Datadog, and DEV#POPPER by Securonix) is a DPRK-aligned intrusion set operating under the Reconnaissance General Bureau and overlapping with the broader Lazarus cluster. Since at least November 2023 the group has run the Contagious Interview campaign, posing as recruiters from cryptocurrency, AI, and Web3 firms to lure software developers into cloning malicious code repositories or installing trojanized npm packages as part of fabricated technical interviews. The two flagship payloads — BeaverTail (initially a JavaScript loader/stealer) and InvisibleFerret (a Python backdoor and infostealer) — have evolved through 2024–2026 to add OtterCookie, OmniStealer, and PylangGhost variants.
The key tradecraft shift documented by Trend Micro in May 2026 is the migration of InvisibleFerret from interpretable Python source (.py) to Cython-compiled native binaries. Cython translates Python source into C, then compiles to platform-native shared objects: PE-format .pyd extension modules on Windows and ELF-format .so shared objects on macOS/Linux. Functionally, the .pyd/.so files are loaded by a small Python launcher stub (`import invisibleferret`) but the stealer logic itself resides inside compiled C code, defeating YARA rules and EDR detections that key on Python AST patterns, string artefacts such as `python-requests` user agents, or known stealer source-level identifiers like `/.n2/pay`, `/.n2/bow`, `/.sysinfo`, and `/pdown`. Cython compilation also strips most plain-text strings, complicating sandbox triage and human reversing, and provides a meaningful uplift over the prior obfuscation regime which relied on trivial Base64-encoded C2 addresses.
BeaverTail's evolution is the second pillar of this report. Originally a Node.js / JavaScript-based first-stage loader whose primary role was to fetch Python from the C2 and stage InvisibleFerret, BeaverTail in 2025–2026 absorbed substantial infostealer capability of its own: enumeration of Chromium-based browser profiles (Chrome, Brave, Edge, Opera) to extract login data, cookies, autofill, and credit cards; targeted harvesting of crypto-wallet browser extensions (MetaMask, Phantom, Solflare, Coinbase Wallet, Trust Wallet, Exodus); clipboard monitoring for wallet-address substitution and seed-phrase capture; keylogging; and screen/keystroke capture. Trend Micro's April 2026 reporting identified more than 750 infected repositories, 500+ malicious VS Code `tasks.json` configurations, and 101 instances of a commit-tampering tool used to silently inject malicious modules into legitimate-looking developer workflows, turning each compromised developer into an onward propagation vector for a worm-like supply-chain compromise of the broader developer ecosystem.
Infection chain (initial access): A Void Dokkaebi operator posing as a recruiter on LinkedIn, Telegram, or job boards directs a target developer to clone a GitHub or Bitbucket repository (frequently themed around chess, trading bots, NFT marketplaces, or Web3 demos) for a coding interview. The repository contains either a malicious `package.json` dependency (e.g. the `node-nvm-ssh` npm package observed in the Chessfi campaign), a malicious VS Code `tasks.json` that fires on workspace open, or a backdoored React/Vue component. Execution invokes the BeaverTail JavaScript loader, which fingerprints the host, attempts a silent Python install if one is absent, fetches the Cython-compiled InvisibleFerret .pyd/.so payload from C2, and chain-loads it via a minimal launcher script. On macOS the .so is dropped under `~/Library/Application Support/.n2/` and loaded via `dlopen()` through a Python shim; on Windows the .pyd is dropped under `%APPDATA%\Python\Python3X\site-packages\` or `%LOCALAPPDATA%\Programs\Python\.n2\`. Persistence is established via launchd plist on macOS (`~/Library/LaunchAgents/com.apple.softwareupdate.plist` and simil
Weaknesses (CWE)
CWE-506, CWE-829, CWE-494, CWE-1357
Target sectors: technology, software-development, cryptocurrency, blockchain, fintech, web3, ai-ml, open-source-ecosystem
Target regions: North America, Europe, South Korea, Japan, India, Southeast Asia
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 29 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1583, T1585, T1587, T1584, T1566, T1195, T1195, T1204, T1059, T1059