North Korean Hackers Deploy BeaverTail–OtterCookie Combo for Keylogging Attacks
## Cybersecurity: Analysis of Recent Malware Activity by Famous Chollima
Cybersecurity: Analysis of Recent Malware Activity by Famous Chollima
Cisco Talos researchers have identified a complex operation conducted by the Famous Chollima subgroup of Lazarus. This campaign utilizes integrated JavaScript tools, specifically BeaverTail and OtterCookie, to execute keylogging, screenshot capture, and data exfiltration.
The operation, known as "Contagious Interview," has significantly evolved, merging various toolsets and introducing new modules for credential theft and surveillance. A recent incident involved a Sri Lankan organization being targeted through a fraudulent job offer, leading to the installation of a trojanized Node.js project named ChessFi.
The npm dependencies of ChessFi included a malicious package, node-nvm-ssh, which activated a sequence of postinstall scripts, ultimately delivering an obfuscated payload. This payload combined BeaverTail’s browser-profile enumeration with OtterCookie’s JavaScript capabilities, including new keylogging features.
Keylogging and Screenshot Capabilities
An undocumented OtterCookie module was discovered, capable of logging keystrokes and capturing screenshots. It employs Node.js packages such as "node-global-key-listener" for keystrokes and "screenshot-desktop" for image capture. Keystrokes are recorded to "1.tmp" and screenshots to "2.jpeg" in a temporary folder, with data being uploaded to an OtterCookie command and control (C2) server at TCP port 1478.
Cisco Talos researchers have identified a complex operation conducted by the Famous Chollima subgroup of Lazarus.
OtterCookie includes a remote shell module, a file upload module, and a cryptocurrency extension stealer targeting Chrome and Brave profiles. A malicious Visual Studio Code extension, posing as an "Onboarding Helper," was also discovered, embedding OtterCookie code directly within the editor environment.
BeaverTail, initially a lightweight downloader for Python-based modules, has been enhanced with code obfuscation and new variants. OtterCookie’s loader has evolved through multiple versions, adding capabilities such as clipboard stealing and file theft, with the latest version incorporating keylogging and screenshot functionalities.
Organizations can mitigate these threats by enforcing application whitelisting, monitoring for unexpected npm dependencies, and utilizing endpoint protection solutions. Network analytics tools can alert on unusual connections to known C2 ports, and regular audits of development environments can further reduce risks.
Based on reporting by GBHackers.