# Void Dokkaebi (Famous Chollima) Cython-Compiled InvisibleFerret — .pyd/.so Binary Evasion of Script-Based Detections (DPRK Contagious Interview)

> North Korea-aligned intrusion set Void Dokkaebi (aka Famous Chollima, PurpleBravo, Tenacious Pungsan, DEV#POPPER) has migrated its InvisibleFerret information-stealer from readable Python scripts to Cython-compiled native binaries, distributing as .pyd extension modules on Windows and .so shared objects on macOS to defeat existing script-based detections. BeaverTail has expanded beyond its prior downloader/stealer role into broader functionality overlapping InvisibleFerret — credential harvesting, browser-extension wallet trojanization (MetaMask, Phantom, Solflare), clipboard hijacking, and keylogging — and is increasingly delivered via the Contagious Interview supply-chain mechanism through trojanized code repositories and malicious npm packages. Active campaign confirmed by Trend Micro in May 2026 against software developers holding cryptocurrency wallet credentials, code-signing keys, and CI/CD pipeline access.

- **Published:** 2026-05-22T12:00:00Z
- **Last reviewed:** 2026-05-22T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0567
- **ID:** TL-2026-0567
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** WageMole (North Korea)
- **Detections:** 9 · **IOCs:** 29 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Void Dokkaebi (also tracked as Famous Chollima by CrowdStrike, PurpleBravo by Recorded Future, Tenacious Pungsan by Datadog, and DEV#POPPER by Securonix) is a DPRK-aligned intrusion set operating under the Reconnaissance General Bureau and overlapping with the broader Lazarus cluster. Since at least November 2023 the group has run the Contagious Interview campaign, posing as recruiters from cryptocurrency, AI, and Web3 firms to lure software developers into cloning malicious code repositories or installing trojanized npm packages as part of fabricated technical interviews. The two flagship payloads — BeaverTail (initially a JavaScript loader/stealer) and InvisibleFerret (a Python backdoor and infostealer) — have evolved through 2024–2026 to add OtterCookie, OmniStealer, and PylangGhost variants.

The key tradecraft shift documented by Trend Micro in May 2026 is the migration of InvisibleFerret from interpretable Python source (.py) to Cython-compiled native binaries. Cython translates Python source into C, then compiles to platform-native shared objects: PE-format .pyd extension modules on Windows and ELF-format .so shared objects on macOS/Linux. Functionally, the .pyd/.so files are loaded by a small Python launcher stub (`import invisibleferret`) but the stealer logic itself resides inside compiled C code, defeating YARA rules and EDR detections that key on Python AST patterns, string artefacts such as `python-requests` user agents, or known stealer source-level identifiers like `/.n2/pay`, `/.n2/bow`, `/.sysinfo`, and `/pdown`. Cython compilation also strips most plain-text strings, complicating sandbox triage and human reversing, and provides a meaningful uplift over the prior obfuscation regime which relied on trivial Base64-encoded C2 addresses.

BeaverTail's evolution is the second pillar of this report. Originally a Node.js / JavaScript-based first-stage loader whose primary role was to fetch Python from the C2 and stage InvisibleFerret, BeaverTail in 2025–2026 absorbed substantial infostealer capability of its own: enumeration of Chromium-based browser profiles (Chrome, Brave, Edge, Opera) to extract login data, cookies, autofill, and credit cards; targeted harvesting of crypto-wallet browser extensions (MetaMask, Phantom, Solflare, Coinbase Wallet, Trust Wallet, Exodus); clipboard monitoring for wallet-address substitution and seed-phrase capture; keylogging; and screen/keystroke capture. Trend Micro's April 2026 reporting identified more than 750 infected repositories, 500+ malicious VS Code `tasks.json` configurations, and 101 instances of a commit-tampering tool used to silently inject malicious modules into legitimate-looking developer workflows, turning each compromised developer into an onward propagation vector for a worm-like supply-chain compromise of the broader developer ecosystem.

Infection chain (initial access): A Void Dokkaebi operator posing as a recruiter on LinkedIn, Telegram, or job boards directs a target developer to clone a GitHub or Bitbucket repository (frequently themed around chess, trading bots, NFT marketplaces, or Web3 demos) for a coding interview. The repository contains either a malicious `package.json` dependency (e.g. the `node-nvm-ssh` npm package observed in the Chessfi campaign), a malicious VS Code `tasks.json` that fires on workspace open, or a backdoored React/Vue component. Execution invokes the BeaverTail JavaScript loader, which fingerprints the host, attempts a silent Python install if one is absent, fetches the Cython-compiled InvisibleFerret .pyd/.so payload from C2, and chain-loads it via a minimal launcher script. On macOS the .so is dropped under `~/Library/Application Support/.n2/` and loaded via `dlopen()` through a Python shim; on Windows the .pyd is dropped under `%APPDATA%\Python\Python3X\site-packages\` or `%LOCALAPPDATA%\Programs\Python\.n2\`. Persistence is established via launchd plist on macOS (`~/Library/LaunchAgents/com.apple.softwareupdate.plist` and similar legitimate-sounding labels), Run-key autostart on Windows (`HKCU\Software\Microsoft\Windows\CurrentVersion\Run`), and scheduled tasks. The compiled InvisibleFerret then connects to hardcoded C2 servers on non-standard high ports including 1224, 1244, 1245, and (per January 2026 variants) 5918, frequently hosted on Russian VPS providers such as Stark Industries Solutions Ltd, completing the previously documented North-Korea-Russia infrastructure pivot.

Post-compromise objectives are unchanged from prior Famous Chollima operations: theft of cryptocurrency wallets and seed phrases, exfiltration of source code and intellectual property, harvest of code-signing certificates and SSH keys, and pivot into CI/CD pipelines (GitHub Actions secrets, GitLab CI runners, Jenkins credentials) for downstream supply-chain compromise. Exfiltration channels include FTP, Telegram Bot API, and direct HTTPS POST to attacker-controlled endpoints. Attribution to DPRK is HIGH-confidence, supported by infrastructure overlap with prior Lazarus operations, code reuse with Tenacious Pungsan / DEV#POPPER samples, victimology overwhelmingly aligned with DPRK regime monetisation objectives (crypto theft funding sanctions evasion), and Russian-DPRK shared C2 hosting documented by Trend Micro in 2025.

Detection implication: Signature-based and YARA detections keyed on Python source strings, `python-requests` user agents, or the historical InvisibleFerret URL paths (`/.n2/pay`, `/.n2/bow`, `/.n2/mlip`, `/pdown`, `/.sysinfo`) will continue to fire on legacy variants but will MISS Cython-compiled samples whose strings are absorbed into compiled C. Defenders must pivot to behavioral detections: anomalous .pyd/.so files outside trusted Python site-packages paths, child-process relationships from `node.exe` or `code.exe` to `python.exe` loading non-standard extension modules, outbound TCP to high non-standard ports (1224, 1244, 1245, 5918) on Russian/Bulgarian VPS netblocks, launchd plist creation under disguised Apple-branded labels, and the IOC families enumerated below.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1585 Establish Accounts
- T1587 Develop Capabilities
- T1584 Compromise Infrastructure
- T1566 Phishing
- T1195 Supply Chain Compromise
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1106 Native API
- T1547 Boot or Logon Autostart Execution
- T1543 Create or Modify System Process
- T1053 Scheduled Task/Job
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1564 Hide Artifacts
- T1140 Deobfuscate/Decode Files or Information
- T1555 Credentials from Password Stores
- T1539 Steal Web Session Cookie
- T1552 Unsecured Credentials
- T1056 Input Capture
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1518 Software Discovery
- T1115 Clipboard Data
- T1113 Screen Capture
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1571 Non-Standard Port
- T1105 Ingress Tool Transfer
- T1102 Web Service
- T1048 Exfiltration Over Alternative Protocol
- T1567 Exfiltration Over Web Service
- T1657 Financial Theft

## Sources

- [Analyzing Void Dokkaebi's Cython-Compiled InvisibleFerret Malware](https://www.trendmicro.com/en_us/research/26/e/analyzing-void-dokkaebi-invisibleferret-malware.html)
- [Void Dokkaebi Uses Fake Job Interview Lure to Spread Malware via Code Repositories](https://www.trendmicro.com/en_us/research/26/d/void-dokkaebi-uses-fake-job-interview-lure-to-spread-malware-via-code-repositories.html)
- [Russian Infrastructure Plays Crucial Role in North Korean Cybercrime Operations](https://www.trendmicro.com/en_us/research/25/d/russian-infrastructure-north-korean-cybercrime.html)
- [Contagious Interview: DPRK Threat Actors Lure Tech Industry Job Seekers](https://unit42.paloaltonetworks.com/north-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters/)
- [Contagious Interview: Malware delivered through fake developer job interviews](https://www.microsoft.com/en-us/security/blog/2026/03/11/contagious-interview-malware-delivered-through-fake-developer-job-interviews/)
- [InvisibleFerret Malware: Technical Analysis](https://any.run/cybersecurity-blog/invisibleferret-malware-analysis/)
- [InvisibleFerret (Malware Family) - Malpedia](https://malpedia.caad.fkie.fraunhofer.de/details/py.invisibleferret)
- [BeaverTail and OtterCookie evolve with a new Javascript module](https://blog.talosintelligence.com/beavertail-and-ottercookie/)
- [PurpleBravo's Targeting of the IT Software Supply Chain](https://www.recordedfuture.com/research/purplebravos-targeting-it-software-supply-chain)
- [North Korea's Contagious Interview Campaign Escalates: 338 Malicious npm Packages](https://socket.dev/blog/north-korea-contagious-interview-campaign-338-malicious-npm-packages)
- [Famous Chollima Adversary Profile - CrowdStrike](https://www.crowdstrike.com/en-us/adversaries/famous-chollima/)
- [Tenacious Pungsan: A DPRK threat actor linked to Contagious Interview](https://securitylabs.datadoghq.com/articles/tenacious-pungsan-dprk-threat-actor-contagious-interview/)
- [Bored BeaverTail & InvisibleFerret Yacht Club – A Lazarus Lure Pt.2](https://www.esentire.com/blog/bored-beavertail-invisibleferret-yacht-club-a-lazarus-lure-pt-2)
- [FOFA 5.0: Tracking APT Contagious Interview IOCs](https://medium.com/@fofabot/fofa-5-0-new-discovery-tracking-apt-contagious-interview-iocs-601e01106029)
- [Contagious Interview (DPRK) Front Companies Delivering BeaverTail, InvisibleFerret, OtterCookie](https://www.silentpush.com/blog/contagious-interview-front-companies/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0567