Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
16 IOCs
New North Korean campaign uses fake coding interviews to steal developer credentials
Threat Actors
Excerpt
Elastic Security Labs found a new Contagious Interview campaign, tracked as REF9403, hiding malware inside SVG image files using steganography. To our knowledge, this specific infection chain has not been previously documented. We found it after the DPRK-aligned group targeted our own community Slack workspace with a fake job posting and a "coding challenge" project. Any user who ran the project ended up with a four-stage payload aligned with OTTERCOOKIE: a browser credential…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(6)
Capability
Victim
Indicators of Compromise
Open the mindmap →16 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | cc97517f80f567977300450de11e9a0be53f52657525a20b1091c99fe9e45730 | Medium | Score 53/100 | First seen |
| SHA256 | 8e571d58794b9b44ae53c2c67bedef72c500e8adbb80aab7a5c263adcba55b1e | Medium | Score 53/100 | First seen |
| SHA256 | fb94b2caee2c40635448a98ba0118421e19a400e74ccff73315f8fa42351f53f | Medium | Score 53/100 | First seen |
| IP | 188.40.64.61 | High | Score 72/100 | First seen |
| Domain | upload.rightwidth.dev | High | Score 72/100 | First seen |
| SHA256 | 96357529d17c4690826d5d4c74deac51743a5388733b3f04004d898f0635ef20 | Medium | Score 53/100 | First seen |
| IP | 195.26.248.212 | High | Score 72/100 | First seen |
| Domain | rightwidth.dev | High | Score 72/100 | First seen |
| SHA256 | 3e6360f83a95540aa2176d279ca4694513afb1e5116a7ffe591c6b5bcf3b9c3c | Medium | Score 53/100 | First seen |
| SHA256 | 4e7639045b4a64de60bfb6312951a5c3dffbd3fb04b84837663242ed27f09864 | Medium | Score 53/100 | First seen |
| Domain | ldb.rightwidth.dev | High | Score 72/100 | First seen |
| SHA256 | 9df01d242ef46adfedf8c35cb7cc67b1d27d7dc4a1ce74ab32e984090d579886 | Medium | Score 53/100 | First seen |
| Domain | file.rightwidth.dev | High | Score 72/100 | First seen |
| Domain | controller.rightwidth.dev | High | Score 72/100 | First seen |
| SHA256 | c5aed4c063d4970a03250778da8041da9e0c83d8f22d2f1994da0ad72567ebd9 | Medium | Score 53/100 | First seen |
| SHA256 | 54bf36910d81ab516037cb3d69d7c85190f90aa0da9e58617799c1fc738dc5a9 | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…