Void Dokkaebi (Famous Chollima) Cython-Compiled InvisibleFerret — .pyd/.so Binary Evasion of Script-Based Detections (DPRK Contagious Interview)

Void Dokkaebi (Famous Chollima) Cython-Compiled (TL-2026-0567), also tracked as Contagious Interview, is a high-severity malware campaign, first published 2026-05-22. It is attributed to WageMole (North Korea) with high confidence, affects Microsoft Windows, maps to 33 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 29 indicators of compromise.

Key facts for TL-2026-0567

Threat ID
TL-2026-0567
Also known as
Contagious Interview, InvisibleFerret Cython Campaign, BeaverTail Evolved, Void Dokkaebi 2026 Wave
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-05-22
Last reviewed
2026-05-22
Attribution
WageMole
Attribution confidence
HIGH
Nation-state nexus
North Korea
Motivation
FINANCIAL
Target sectors
technology, software-development, cryptocurrency, blockchain, fintech, web3, ai-ml, open-source-ecosystem
Target regions
North America, Europe, South Korea, Japan, India, Southeast Asia
Detection rules
9
Indicators of compromise
29

Malware and tooling in Void Dokkaebi (Famous Chollima) Cython-Compiled

Malware and tooling: BeaverTail - S1246, InvisibleFerret - S1245, OtterCookie, Cython

North Korea-aligned intrusion set Void Dokkaebi (aka Famous Chollima, PurpleBravo, Tenacious Pungsan, DEV#POPPER) has migrated its InvisibleFerret information-stealer from readable Python scripts to Cython-compiled native binaries, distributing as .pyd extension modules on Windows and .so shared objects on macOS to defeat existing script-based detections. BeaverTail has expanded beyond its prior downloader/stealer role into broader functionality overlapping InvisibleFerret — credential harvesting, browser-extension wallet trojanization (MetaMask, Phantom, Solflare), clipboard hijacking, and keylogging — and is increasingly delivered via the Contagious Interview supply-chain mechanism through trojanized code repositories and malicious npm packages. Active campaign confirmed by Trend Micro in May 2026 against software developers holding cryptocurrency wallet credentials, code-signing keys, and CI/CD pipeline access.

How Void Dokkaebi (Famous Chollima) Cython-Compiled works

Void Dokkaebi (also tracked as Famous Chollima by CrowdStrike, PurpleBravo by Recorded Future, Tenacious Pungsan by Datadog, and DEV#POPPER by Securonix) is a DPRK-aligned intrusion set operating under the Reconnaissance General Bureau and overlapping with the broader Lazarus cluster. Since at least November 2023 the group has run the Contagious Interview campaign, posing as recruiters from cryptocurrency, AI, and Web3 firms to lure software developers into cloning malicious code repositories or installing trojanized npm packages as part of fabricated technical interviews. The two flagship payloads — BeaverTail (initially a JavaScript loader/stealer) and InvisibleFerret (a Python backdoor and infostealer) — have evolved through 2024–2026 to add OtterCookie, OmniStealer, and PylangGhost variants.

The key tradecraft shift documented by Trend Micro in May 2026 is the migration of InvisibleFerret from interpretable Python source (.py) to Cython-compiled native binaries. Cython translates Python source into C, then compiles to platform-native shared objects: PE-format .pyd extension modules on Windows and ELF-format .so shared objects on macOS/Linux. Functionally, the .pyd/.so files are loaded by a small Python launcher stub (`import invisibleferret`) but the stealer logic itself resides inside compiled C code, defeating YARA rules and EDR detections that key on Python AST patterns, string artefacts such as `python-requests` user agents, or known stealer source-level identifiers like `/.n2/pay`, `/.n2/bow`, `/.sysinfo`, and `/pdown`. Cython compilation also strips most plain-text strings, complicating sandbox triage and human reversing, and provides a meaningful uplift over the prior obfuscation regime which relied on trivial Base64-encoded C2 addresses.

BeaverTail's evolution is the second pillar of this report. Originally a Node.js / JavaScript-based first-stage loader whose primary role was to fetch Python from the C2 and stage InvisibleFerret, BeaverTail in 2025–2026 absorbed substantial infostealer capability of its own: enumeration of Chromium-based browser profiles (Chrome, Brave, Edge, Opera) to extract login data, cookies, autofill, and credit cards; targeted harvesting of crypto-wallet browser extensions (MetaMask, Phantom, Solflare, Coinbase Wallet, Trust Wallet, Exodus); clipboard monitoring for wallet-address substitution and seed-phrase capture; keylogging; and screen/keystroke capture. Trend Micro's April 2026 reporting identified more than 750 infected repositories, 500+ malicious VS Code `tasks.json` configurations, and 101 instances of a commit-tampering tool used to silently inject malicious modules into legitimate-looking developer workflows, turning each compromised developer into an onward propagation vector for a worm-like supply-chain compromise of the broader developer ecosystem.

Infection chain (initial access): A Void Dokkaebi operator posing as a recruiter on LinkedIn, Telegram, or job boards directs a target developer to clone a GitHub or Bitbucket repository (frequently themed around chess, trading bots, NFT marketplaces, or Web3 demos) for a coding interview. The repository contains either a malicious `package.json` dependency (e.g. the `node-nvm-ssh` npm package observed in the Chessfi campaign), a malicious VS Code `tasks.json` that fires on workspace open, or a backdoored React/Vue component. Execution invokes the BeaverTail JavaScript loader, which fingerprints the host, attempts a silent Python install if one is absent, fetches the Cython-compiled InvisibleFerret .pyd/.so payload from C2, and chain-loads it via a minimal launcher script. On macOS the .so is dropped under `~/Library/Application Support/.n2/` and loaded via `dlopen()` through a Python shim; on Windows the .pyd is dropped under `%APPDATA%\Python\Python3X\site-packages\` or `%LOCALAPPDATA%\Programs\Python\.n2\`. Persistence is established via launchd plist on macOS (`~/Library/LaunchAgents/com.apple.softwareupdate.plist` and similar legitimate-sounding labels), Run-key autostart on Windows (`HKCU\Software\Microsoft\Windows\CurrentVersion\Run`), and scheduled tasks. The compiled InvisibleFerret then connects to hardcoded C2 servers on non-standard high ports including 1224, 1244, 1245, and (per January 2026 variants) 5918, frequently hosted on Russian VPS providers such as Stark Industries Solutions Ltd, completing the previously documented North-Korea-Russia infrastructure pivot.

Post-compromise objectives are unchanged from prior Famous Chollima operations: theft of cryptocurrency wallets and seed phrases, exfiltration of source code and intellectual property, harvest of code-signing certificates and SSH keys, and pivot into CI/CD pipelines (GitHub Actions secrets, GitLab CI runners, Jenkins credentials) for downstream supply-chain compromise. Exfiltration channels include FTP, Telegram Bot API, and direct HTTPS POST to attacker-controlled endpoints. Attribution to DPRK is HIGH-confidence, supported by infrastructure overlap with prior Lazarus operations, code reuse with Tenacious Pungsan / DEV#POPPER samples, victimology overwhelmingly aligned with DPRK regime monetisation objectives (crypto theft funding sanctions evasion), and Russian-DPRK shared C2 hosting documented by Trend Micro in 2025.

Detection implication: Signature-based and YARA detections keyed on Python source strings, `python-requests` user agents, or the historical InvisibleFerret URL paths (`/.n2/pay`, `/.n2/bow`, `/.n2/mlip`, `/pdown`, `/.sysinfo`) will continue to fire on legacy variants but will MISS Cython-compiled samples whose strings are absorbed into compiled C. Defenders must pivot to behavioral detections: anomalous .pyd/.so files outside trusted Python site-packages paths, child-process relationships from `node.exe` or `code.exe` to `python.exe` loading non-standard extension modules, outbound TCP to high non-standard ports (1224, 1244, 1245, 5918) on Russian/Bulgarian VPS netblocks, launchd plist creation under disguised Apple-branded labels, and the IOC families enumerated below.

MITRE ATT&CK techniques used in TL-2026-0567

Collection

T1005 Data from Local System; T1113 Screen Capture; T1115 Clipboard Data

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1564 Hide Artifacts

Exfiltration

T1048 Exfiltration Over Alternative Protocol; T1567 Exfiltration Over Web Service

Persistence

T1053 Scheduled Task/Job; T1543 Create or Modify System Process; T1547 Boot or Logon Autostart Execution

Credential Access

T1056 Input Capture; T1539 Steal Web Session Cookie; T1552 Unsecured Credentials; T1555 Credentials from Password Stores

Execution

T1059 Command and Scripting Interpreter; T1106 Native API; T1204 User Execution

Command and Control

T1071 Application Layer Protocol; T1102 Web Service; T1105 Ingress Tool Transfer; T1571 Non-Standard Port

Discovery

T1082 System Information Discovery; T1083 File and Directory Discovery; T1518 Software Discovery

Initial Access

T1195 Supply Chain Compromise; T1566 Phishing

Resource Development

T1583 Acquire Infrastructure; T1584 Compromise Infrastructure; T1585 Establish Accounts; T1587 Develop Capabilities

Impact

T1657 Financial Theft

Affected products and versions in Void Dokkaebi (Famous Chollima) Cython-Compiled

  • Microsoft — Windows
    Vulnerable versions: 10; 11; Server 2019; Server 2022
  • Apple — macOS
    Vulnerable versions: 13 Ventura; 14 Sonoma; 15 Sequoia
  • Microsoft — Visual Studio Code
    Vulnerable versions: all versions with auto-task execution
  • npm — npm Registry packages
    Vulnerable versions: node-nvm-ssh and 300+ associated trojanized packages
  • MetaMask — MetaMask Browser Extension
    Vulnerable versions: all versions
  • Phantom — Phantom Wallet Browser Extension
    Vulnerable versions: all versions

Remediation for Void Dokkaebi (Famous Chollima) Cython-Compiled

Immediate actions

  • Block outbound TCP to non-standard high ports (1224, 1244, 1245, 5918) on perimeter and host firewalls for developer endpoints
  • Block known C2 IPs at perimeter: 95.164.17.24, 172.93.201.253, 172.86.105.40, 23.106.253.194
  • Enumerate developer endpoints for unauthorised .pyd files outside Python site-packages and .so files under ~/Library/Application Support/.n2/ on macOS
  • Audit recently cloned GitHub/Bitbucket repositories and VS Code tasks.json files for malicious autorun tasks
  • Quarantine and review all developer machines that ran a code repository as part of any unsolicited recruitment outreach in the last 12 months
  • Rotate code-signing certificates, SSH keys, and CI/CD secrets accessible from any compromised developer endpoint

Workarounds

  • Run untrusted interview repositories inside disposable VMs or remote dev containers (GitHub Codespaces, Gitpod) rather than on the corporate workstation
  • Disable VS Code automatic tasks.json execution on workspace open (set security.workspace.trust.untrustedFiles to prompt)
  • Block Python.org installer downloads from non-management-approved networks to break BeaverTail's silent Python staging step

Longer-term hardening

  • Deploy EDR with native PE/ELF behavioural detection — do not rely on Python script-only YARA
  • Mandate developer training on Contagious Interview tradecraft (recruiter-driven repo clone lures)
  • Adopt npm install allowlisting / Socket / Snyk for npm-package risk scoring on developer workstations
  • Segment developer workstations from production CI/CD on dedicated VLAN with explicit allowlisted egress
  • Enforce hardware-token-backed signing keys (YubiKey, HSM) so theft of on-disk keys is insufficient for downstream signing
  • Implement GitHub Actions / GitLab CI OIDC short-lived tokens instead of long-lived PATs

Weaknesses (CWE) in Void Dokkaebi (Famous Chollima) Cython-Compiled

CWE-506, CWE-829, CWE-494, CWE-1357

Timeline of Void Dokkaebi (Famous Chollima) Cython-Compiled

  • Palo Alto Unit 42 publishes initial Contagious Interview report naming BeaverTail and InvisibleFerret, attributing operation to DPRK threat actors using fake recruiter lures.
  • CrowdStrike publishes Famous Chollima adversary profile linking the cluster to the DPRK Reconnaissance General Bureau and Lazarus umbrella.
  • Datadog Security Labs publishes Tenacious Pungsan analysis disclosing additional npm-package infrastructure overlap with Contagious Interview.
  • Trend Micro discloses Russian VPS infrastructure (Stark Industries, others) hosting DPRK Void Dokkaebi C2 — North Korea/Russia operational convergence confirmed.
  • Socket reports 338 malicious npm packages tied to the Contagious Interview campaign, signalling escalation to mass supply-chain delivery.
  • Cisco Talos publishes BeaverTail/OtterCookie evolution analysis documenting absorption of broader stealer functionality into BeaverTail JS module.
  • Researchers identify Contagious Interview variant with hardcoded C2 IP 172.86.105.40:5918, previously unreported in public threat-intel; port scanning reveals ~20 additional sibling servers.
  • Microsoft Threat Intelligence publishes Contagious Interview blog documenting Microsoft's victim notification and detection telemetry.
  • Trend Micro discloses 750+ infected GitHub/Bitbucket repositories, 500+ malicious VS Code tasks.json, and 101 commit-tampering tool instances — Void Dokkaebi is now a worm-like supply-chain operation.
  • Trend Micro (Kazuki Fujisawa) publishes the Cython-compiled InvisibleFerret analysis disclosing the .pyd/.so binary migration that defeats script-based detections; Threadlinqs Intelligence opens TL-2026-0567.
  • As of 2026-05-29, this DPRK Void Dokkaebi (Famous Chollima) Contagious Interview threat is ACTIVE: Trend Micro's 22 May 2026 Cython .pyd/.so InvisibleFerret evasion disclosure is being amplified industry-wide, and Socket tracks 1,700+ live malicious packages (incl. the Axios poisoning). DOJ/FBI actions hit DPRK IT-worker fraud but did not neutralize the BeaverTail/InvisibleFerret toolchain or campaign.

Sources cited for Void Dokkaebi (Famous Chollima) Cython-Compiled

Threats related to Void Dokkaebi (Famous Chollima) Cython-Compiled

Detection coverage for TL-2026-0567

As of 2026-05-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0567 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats