Malware

Suspected Chinese-speaking threat actors distributed malicious emails with a ZIP archive.

Attacks commenced with the execution of seemingly harmless files that install an evasive library.

SecurityWeek reports that North Korean hackers have leveraged fraudulent job offers to compromise freelance software developers with malicious payloads as part of the DeceptiveDevelopment attack campaign, which has been underway since early last year.

Security researchers confirmed the malware’s nature after analyzing samples that mimicked popular apps such as WhatsApp as well as cellphone provider customer support tools.

First of the free tools is a comprehensive Semgrep and Opengrep ruleset that could be used in continuous integration and continuous deployment pipelines, which has yielded 94.3% and 88.4% accuracy in identifying nefarious code in PyPI and NPM packages, respectively.

Intrusions begin with the spread of a compressed ZIP archive containing a renamed jarsigner.exe file, which when executed prompts the loading of a tampered DLL library and eventual injection of XLoader malware, according to an analysis from the AhnLab Security Intelligence Center.

After initially compromising Check Point Security Gateways through the exploitation of the CVE-2024-24919 vulnerability, Green Nailao proceeded to deliver a stealthier variant of the ShadowPad malware and the PlugX backdoor to facilitate the execution of NailaoLocker, a report from Orange Cyberdefense researchers revealed.