OtterCookieMalware
Last reported 9 days ago, by AhnLab ASEC4 reports
ATT&CK techniques
6 techniques · each with the sentence it comes from- T1213.003Code Repositories
“During technical interviews or coding assignments, victims were told to download and run files hosted on developer platforms and code repositories.”
- T1552.004Private Keys
“The modules loaded malicious code that extracted and stole crypto-wallet private keys.”
- T1684Social Engineering
“Rust warns of ongoing social engineering campaign: The Rust programming language warns that a threat actor is targeting its core members and owners of popular libraries.”
- T1053.005Scheduled Task
“Callisto deployed CosmicPulse using RedFlick (a scheduled task-based delivery technique), while UAC-0099 attempted to disrupt AI analysis using GuardBreaker (an LLM-based obfuscation technique).”
- T1204.003Malicious Image
“The vulnerabilities allow attackers to use malicious image files to run malicious code on remote services.”
- T1218.002Control Panel
“VHDX, LNK, PDF, HTA, WSF, MSI, and Control Panel applets were combined.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
4 reports, newest first · the exact sentence from each-
September 2026 Threat Trend Report on APT Groups“Famous Chollima’s “Contagious Interview” relied on OtterCookie (malware with Information Theft and remote access capabilities), while PolinRider focused on propagation using compromised GitHub accounts and repositories.”
-
North Korean Attackers Hit 30,000 Devices and Steal $10.7m“The actors seeded malicious NPM packages carrying BeaverTail, InvisibleFerret, OtterCookie, OtterCandy or StoatWaffle.”
-
Risky Bulletin: Gemini hacked three companies too“…nfostealer named WeaselBiscuit, which appears to be a stripped-down version of previous North Korean infostealers like BeaverTail and OtterCookie.”
-
Void Dokkaebi Uses Fake Job Interview Lure to Spread Malware via Code Repositories“…t by simply updating the blockchain reference, including other malware that have been linked to North Korea, such as InvisibleFerret, OtterCookie, OmniStealer, DEV#POPPER, and BeaverTail, all of which have been observed in Void Dokkaebi’s operations.”
Indicators in its reports
named in the reports above- itorrents[.]orgin 1 report
- socket[.]ioin 1 report
- api.trongrid[.]ioin 1 report
- fullnode.mainnet.aptoslabs[.]comin 1 report
- 136.0.9[.]8in 1 report
- 198.105.127[.]210in 1 report
- 23.27.202[.]27in 1 report
- 154.91.0[.]196in 1 report
- 23.27.20[.]143in 1 report
- 85.239.62[.]36in 1 report
- 83.168.68[.]219in 1 report
- 166.88.4[.]2in 1 report
- 23.27.120[.]142in 1 report
- onionmail[.]comin 1 report
- marktsec.bsky[.]socialin 1 report
- sethmlarson[.]devin 1 report
- shakirov2036.bsky[.]socialin 1 report
- pwn[.]aiin 1 report
Copy these 18 indicators · defanged
Thanks — we review every report.