The IT Nerd

Today, Silent Push released that its threat analysts have uncovered three cryptocurrency companies that are actually fronts for the North Korean APT group Contagious Interview: BlockNovas LLC, Angeloper Agency, and SoftGlide LLC.

Silent Push’s malware analysts confirmed that three strains, BeaverTail, InvisibleFerret, and OtterCookie, are being used to spread malware via “interview malware lures” to unsuspecting cryptocurrency job applicants.

The threat actor heavily uses AI-generated images to create profiles of “employees” for the three front crypto companies. As part of the crypto attacks, the threat actors are heavily using Github, job listing, and freelancer websites.

This is now live at https://www.silentpush.com/blog/contagious-interview-front-companies/

Today, Silent Push announced that its threat analysts have discovered threat actors enabled by mainstream cloud providers, including Amazon Web Services (AWS) and Microsoft Azure. 

New details uncovered in the course of this reporting indicate that FUNNULL is likely using fraudulent or stolen accounts to acquire these IPs to map to their CNAMEs, and providers we have spoken to claim this wasn’t caught in real time due to visibility holes from the technical complexity of their DNS architecture.

Additional key findings include:

• FUNNULL has rented over 1,200 IPs from Amazon and nearly 200 from Microsoft. Although most IPs have been taken down, new ones are acquired every few weeks.
• There are indications of FUNNULL illicitly acquiring the IPs using stolen or fraudulent accounts. However, external visibility into this process is limited.
• Money laundering is directly associated with a service hosted on shell websites, retail phishing schemes, and pig-butchering scams being kept online via infrastructure laundering.

This is now live at https://www.silentpush.com/blog/infrastructure-laundering/.