WageMoleThreat actor

“CrowdStrike, which helped the FBI investigate, tracks the group behind this operation as Famous Chollima and describes the laptop farm infrastructure as vital to overcoming the physical and legal barriers of operating from outside the US.”

“Famous Chollima, Kimsuky, and Konni primarily targeted developers and IT professionals.”

“The operation, also tracked as Famous Chollima, purpledelta, and Wagemole, revolves around North Korean IT workers getting hired at American and other companies using fake identities, drawing regular salaries, a chunk of which is funneled back to the regime.”

“…ty firm CrowdStrike, which helped the FBI disrupt the operation, tracks this group of North Korean IT workers and their helpers as “Famous Chollima.””

“Famous Chollima”

“In April, we published research on PromptMink, a campaign we tie to the North Korean group Famous Chollima.”

“North Korean “WaterPlum,” commonly referred to as “Contagious Interview,” Cyber Actor Group Targeting IT Professionals; Activities of North Korean IT Workers in Japan, the United States and Europe”

“North Korean “WaterPlum,” commonly referred to as “Contagious Interview,” Cyber Actor Group Targeting IT Professionals; Activities of North Korean IT Workers in Japan, the United States and Europe”

“North Korea's WaterPlum group, commonly referred to as Contagious Interview, has infected at least 30,000 devices in more than 100 countries and taken funds or credentials from over 7,000 cryptocurrency wallets, according to a new joint advisory.”

“US, Japanese, Australian, and German authorities warned about WaterPlum (Contagious Interview), a North Korea-linked campaign that infected at least 30,000 devices across more than 100 countries.”

“WaterPlum linked to DPRK MID: Cybersecurity and law enforcement agencies from multiple countries have linked the WaterPlum APT group to the 313 General Bureau of North Korea's Munitions Industry Department.”

“The agencies track the activity collectively as WaterPlum.”

“Famous Chollima continued its PolinRider supply chain attacks, and stealthy C2 techniques utilizing the Ethereum blockchain were identified.”

“…n September 7, categorized the former Lazarus umbrella into TEMP.Hermit, Citrine Sleet, CryptoCore, Jade Sleet, Moonstone Sleet and Famous Chollima.”

“…tting the Lazarus umbrella into six distinct sub-clusters: TEMP.Hermit, Citrine Sleet, CryptoCore, Jade Sleet, Moonstone Sleet, and Famous Chollima.”

“In cases linked to Famous Chollima, the group compromised GitHub maintainer accounts and legitimate repositories to inject obfuscated JavaScript loaders into npm, Packagist, Go modules, and Chrome extensions, thereby committing credential theft, browser data theft, and cryptocurr…”

“Attributed to the notorious North Korean-aligned hacking group Famous Chollima, also known as Wagemole, the campaign leverages fraudulent job interviews and highly interactive web portals to trick candidates into installing remote access trojans (RATs) on their personal devices.”

“Analyzing Void Dokkaebi’s Cython-Compiled InvisibleFerret Malware”

“Void Dokkaebi Uses Fake Job Interview Lure to Spread Malware via Code Repositories”

“Indeed, the researchers also recently described the Wagemole IT worker campaigns in which North Korea-aligned individuals attempt to gain employment at overseas companies.”