H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

InvisibleFerret

[InvisibleFerret](https://attack.mitre.org/software/S1245) is a modular python malware that is leveraged for data exfiltration and remote access capabilities.(Citation: ESET Contagious Interview BeaverTail InvisibleFerret February 2025)(Citation: Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024)(Citation: PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023) [InvisibleFerret](https://attack.mitre.org/software/S1245) consists of four modules: main, payload, browser, and AnyDesk.(Citation: ESET Contagious Interview BeaverTail InvisibleFerret February 2025) [InvisibleFerret](https://attack.mitre.org/software/S1245) malware has been leveraged by North Korea-affiliated threat actors identified as DeceptiveDevelopment or [Contagious Interview](https://attack.mitre.org/groups/G1052) since 2023.(Citation: Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025)(Citation: Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024)(Citation: PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023)(Citation: PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024) [InvisibleFerret](https://attack.mitre.org/software/S1245) has historically been introduced to the victim environment through the use of the [BeaverTail](https://attack.mitre.org/software/S1246) malware.(Citation: Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024)(Citation: ESET Contagious Interview BeaverTail InvisibleFerret February 2025)(Citation: Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024)(Citation: PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023)(Citation: PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[InvisibleFerret](https://attack.mitre.org/software/S1245) is a modular python malware that is leveraged for data exfiltration and remote access capabilities.(Citation: ESET Contagious Interview BeaverTail InvisibleFerret February 2025)(Citation: Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024)(Citation: PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023) [InvisibleFerret](https://attack.mitre.org/software/S1245) consists of four modules: main, payload, browser, and AnyDesk.(Citation: ESET Contagious Interview BeaverTail InvisibleFerret February 2025) [InvisibleFerret](https://attack.mitre.org/software/S1245) malware has been leveraged by North Korea-affiliated threat actors identified as DeceptiveDevelopment or [Contagious Interview](https://attack.mitre.org/groups/G1052) since 2023.(Citation: Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025)(Citation: Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024)(Citation: PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023)(Citation: PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024) [InvisibleFerret](https://attack.mitre.org/software/S1245) has historically been introduced to the victim environment through the use of the [BeaverTail](https://attack.mitre.org/software/S1246) malware.(Citation: Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024)(Citation: ESET Contagious Interview BeaverTail InvisibleFerret February 2025)(Citation: Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024)(Citation: PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023)(Citation: PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024)

Labels

malware
36 recorded

Relationships

uses
from Contagious Interview
Group
uses
to Archive via Utility
Technique
uses
to Clipboard Data
Technique
uses
to Credentials from Web Browsers
Technique
uses
to Data from Local System
Technique
uses
to Deobfuscate/Decode Files or Information
Technique
uses
to Encrypted/Encoded File
Technique
uses
to Exfiltration Over C2 Channel
Technique
uses
to Exfiltration Over Unencrypted Non-C2 Protocol
Technique
uses
to Exfiltration Over Web Service
Technique
uses
to File and Directory Discovery
Technique
uses
to Financial Theft
Technique
uses
to Hidden Window
Technique
uses
to Ingress Tool Transfer
Technique
uses
to Input Capture
Technique
uses
to Keylogging
Technique
uses
to Launch Agent
Technique
uses
to Local Account
Technique
uses
to Local Data Staging
Technique
uses
to Non-Application Layer Protocol
Technique
uses
to Non-Standard Port
Technique
uses
to Password Managers
Technique
uses
to PowerShell
Technique
uses
to Process Discovery
Technique
uses
to Python
Technique
uses
to Registry Run Keys / Startup Folder
Technique
uses
to Remote Access Tools
Technique
uses
to Selective Exclusion
Technique
uses
to Service Stop
Technique
uses
to Software Discovery
Technique
uses
to System Information Discovery
Technique
uses
to System Location Discovery
Technique
uses
to System Network Configuration Discovery
Technique
uses
to System Owner/User Discovery
Technique
uses
to Web Protocols
Technique
uses
to XDG Autostart Entries
Technique
7 external

References

mitre-attack
S1245
open
Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024
https://www.esentire.com/blog/bored-beavertail-invisibleferret-yacht-club-a-lazarus-lure-pt-2
open
Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025
https://www.recordedfuture.com/research/inside-the-scam-north-koreas-it-worker-threat
open
ESET Contagious Interview BeaverTail InvisibleFerret February 2025
https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/
open
Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024
https://www.zscaler.com/blogs/security-research/pyongyang-your-payroll-rise-north-korean-remote-workers-west
open
PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023
https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/
open
PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024
https://unit42.paloaltonetworks.com/north-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters/
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance