Threat reportMalwareTL-2026-3920
Void Dokkaebi (Famous Chollima) Cython-Compiled InvisibleFerret Infostealer Campaign
Void Dokkaebi (Famous Chollima) Cython-Compiled (TL-2026-3920), also tracked as BeaverTail, is a high-severity malware campaign, first published 2026-10-20. It is attributed to WageMole (North Korea) with medium confidence, affects Microsoft Windows (developer workstations), maps to 19 MITRE ATT&CK techniques (T1027, T1053.005, T1056.001), and is covered by 9 detection rules and 29 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 19MITRE ATT&CK
- Actors
- 1WageMole
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 29Indicators of compromise
Key facts for TL-2026-3920
- Threat ID
- TL-2026-3920
- Also known as
- BeaverTail, InvisibleFerret, Cython-compiled InvisibleFerret
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- WageMole
- Attribution confidence
- MEDIUM
- Nation-state nexus
- North Korea
- Motivation
- FINANCIAL
- Target sectors
- technology, cryptocurrency, blockchain, software development
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 29
Malware and tooling in Void Dokkaebi (Famous Chollima) Cython-Compiled
Malware and tooling: BeaverTail - S1246, InvisibleFerret - S1245
How Void Dokkaebi (Famous Chollima) Cython-Compiled works
Trend Micro reports the North Korea-aligned intrusion set Void Dokkaebi (aka Famous Chollima) uses fake job-interview lures against software developers to deploy BeaverTail and InvisibleFerret. InvisibleFerret is now compiled with Cython into .pyd (Windows) and .so (macOS) modules, providing backdoor access, browser credential theft, clipboard monitoring, keylogging (Windows) and cryptocurrency wallet targeting.
Void Dokkaebi, tracked by others as Famous Chollima, is a North Korea-aligned intrusion set that targets software developers with access to cryptocurrency wallets, signing keys, CI/CD pipelines and production infrastructure. Initial contact is a fake job interview lure. The infection chain starts with BeaverTail, a JavaScript downloader/stealer, which retrieves further BeaverTail variants and finally InvisibleFerret.
Trend Micro (Kazuki Fujisawa, 2026-05-22) documents four BeaverTail variants that appeared from October 2025. BeaverTail (gjs) steals browser and cryptocurrency wallet data and downloads BeaverTail (njs), (zjs) and InvisibleFerret. (njs) is a backdoor with ssh_-prefixed functions that also collects system/network information and geolocates the host via ip-api.com. (zjs) steals wallet data, seed phrases, private keys and passwords. (cjs) downloads and installs trojanized Chrome and Brave extensions, including MetaMask, Coinbase Wallet and Phantom lookalikes. BeaverTail obfuscation combines shuffled arrays of roughly 300 Base64 fragments via an IIFE, random junk-byte prefixes, a 4-byte XOR key for sensitive paths and commands, and split-and-swap encoding of C&C IP addresses before Base64 decoding.
The key evolution is that InvisibleFerret is no longer delivered as readable Python scripts. It is compiled with Cython into native extension modules (.pyd on Windows, .so on macOS) that need a small Python wrapper script (.mod files) to load them. Modules: mod (downloads pad.pyd and brw.pyd on Windows, pad.so on macOS), pad (backdoor with ssh_-prefixed execution functions), brw (browser authentication and credit-card theft) and mc.so (macOS; installs trojanized Chrome/Brave extensions and can downgrade the installed Chrome version; the only module that deletes its execution script). Binaries export PyInit_mod, PyInit_pad and PyInit_brw and retain .pyx/.c source path references and macOS build paths (/Users/administrator/Pictures/Work/py_module_work/build/temp.macosx-10.13-universal2-cpython-312/). Python string constants are Zlib-compressed (CYTHON_COMPRESS_STRINGS). C&C addresses are stored as 16-character XOR-encoded strings (for example 91d840f599206f13 decodes to 45.59.160.199) with ports defined in the binary or passed as runtime arguments. The unchanged deobfuscation logic is a lambda that reverses, Base64-decodes and iteratively Zlib-decompresses. Next-stage download paths changed from /client/{sType} to /clw/{sType} (Windows) and /clw1/{sType} (macOS) and are saved as main_{sType}.py; next-stage scripts are pad0, brw0 and mc0. Trend Micro observed incomplete Cython migration, indicating active development.
Defenders should move from script-only detection to binary-aware detection: hunt for .pyd/.so/.mod files in developer directories (including .vscode), Python interpreters launched with suspicious arguments, browser-extension tampering, and Chrome/Brave downgrade on macOS. Context from PolySwarm shows the same ecosystem merging BeaverTail with OtterCookie, using RC4-encrypted HTTP C2 and a malicious npm package (node-nvm-ssh) embedded in trojanized Node.js applications.
MITRE ATT&CK techniques used in TL-2026-3920
Defense Evasion
T1027 Obfuscated Files or Information; T1070.004 Indicator Removal: File Deletion; T1140 Deobfuscate/Decode Files or Information
Persistence
T1053.005 Scheduled Task/Job: Scheduled Task; T1176.001 Browser Extensions; T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Collection
T1056.001 Input Capture: Keylogging
Discovery
T1057 Process Discovery; T1082 System Information Discovery; T1518 Software Discovery
Execution
T1059.006 Command and Scripting Interpreter: Python; T1059.007 Command and Scripting Interpreter: JavaScript; T1204.002 User Execution: Malicious File
Command and Control
T1071.001 Application Layer Protocol: Web Protocols; T1219 Remote Access Tools; T1571 Non-Standard Port
Credential Access
T1555.003 Credentials from Password Stores: Credentials from Web Browsers
Initial Access
defense-impairment
Affected products and versions in Void Dokkaebi (Famous Chollima) Cython-Compiled
Remediation for Void Dokkaebi (Famous Chollima) Cython-Compiled
Immediate actions
- Block and alert on the C&C and payload-delivery IPs and ports listed in the IOCs
- Hunt for .pyd, .so and .mod files and Python processes loading them from developer or .vscode directories
- Isolate hosts where a job-interview coding assignment was run; rotate wallet seed phrases, signing keys, browser-stored credentials and CI/CD/production secrets exposed on them
- Audit Chrome and Brave for unexpected extensions (MetaMask, Coinbase Wallet, Phantom lookalikes) and unexpected browser version downgrades on macOS
Workarounds
- Restrict browser extension installation via enterprise policy
- Restrict outbound connections to non-standard ports (1242-1249) from developer workstations
Longer-term hardening
- Train developers to treat interview coding tests and take-home repositories as untrusted code and run them only in disposable VMs
- Deploy EDR with binary-aware detection of Python extension modules and abnormal interpreter arguments
- Separate wallet, signing-key and production access from machines used for personal job-search activity
Timeline of Void Dokkaebi (Famous Chollima) Cython-Compiled
- BeaverTail reported active since at least mid-2023 (PolySwarm); date approximate.
- OtterCookie evolution (v1-v5) begins in late 2024 and continues to August 2025 (PolySwarm); date approximate.
- OtterCookie gains keylogging and screenshot capture module (PolySwarm); date approximate.
- New BeaverTail variants (gjs, njs, zjs, cjs) emerge per Trend Micro; date approximate.
- Report indexed in Malpedia, linking js.beavertail, py.invisibleferret and actor Void Dokkaebi.
- Trend Micro publishes analysis of Void Dokkaebi's Cython-compiled InvisibleFerret (.pyd/.so) and associated IoCs.
Sources cited for Void Dokkaebi (Famous Chollima) Cython-Compiled
- Analyzing Void Dokkaebi's Cython-Compiled InvisibleFerret Malware
- Void Dokkaebi Cython-Compiled InvisibleFerret IoC list (Trend Micro)
- Malpedia library entry: Analyzing Void Dokkaebi's Cython-Compiled InvisibleFerret Malware
- PolySwarm: Famous Chollima Evolves Its Arsenal, Merging BeaverTail and OtterCookie
- CrowdStrike Adversary Profile: Famous Chollima
- Malpedia actor: WageMole
Detection coverage for TL-2026-3920
As of 2026-10-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3920 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.