Chollima APT Hackers Target Job Seekers and Organizations with JavaScript Malware Attacks

In a wave of attacks attributed to the infamous Chollima Advanced Persistent Threat (APT) group, software developers and IT professionals seeking employment have become prime targets, as the adversary cleverly leverages social engineering and supply chain compromise for intrusion.

These campaigns, first observed in December 2022, employ a highly tailored scheme: victims are lured with fake job interviews and then tricked into running malicious software disguised as legitimate coding challenges hosted on trusted developer platforms.

Abuse of GitHub and NPM: Modern Supply Chain Threats

Once contact is made, attackers invite their targets to an “interview” conducted over video conferencing platforms.

Capitalizing on the technical backgrounds of their victims, the attackers request them to download and review a JavaScript package hosted on GitHub.

This package, distributed via Node Package Manager (NPM), appears innocuous but secretly harbors obfuscated JavaScript code specifically crafted to compromise the victim’s environment.

Experts from Palo Alto Networks’ Unit 42 report that the malicious NPM package acts as the initial infection vector.

The code within these packages is heavily obfuscated and designed to blend in with regular software development activities, making early detection challenging.

During simulations, even seasoned developers found it difficult to distinguish between legitimate code and the concealed threat until after execution.

Multi-Stage Backdoor: Python Payload and C2 Communication

Following initial infection, the second stage unfolds as the NPM package drops a Python-based backdoor, codenamed “InvisibleFerret,” onto the compromised system.

This payload further extends the attacker’s reach by establishing an encrypted TCP command-and-control (C2) channel, secured using XOR encryption and JSON-based instructions from the remote server.

The Python script, which is cross-platform, executes a variety of post-exploitation actions, such as harvesting browser credentials and executing arbitrary commands relayed from the attackers.

Notably, this choice of Python as a payload was strategic; targeted individuals, primarily software engineers, are likely to have the language and required libraries pre-installed.

The attackers rely on this environment to enable stealthy, platform-independent compromise without raising the pangs of suspicion commonly associated with running foreign executables.

Security researchers highlight how this campaign underscores the growing threat of supply chain attacks within the developer ecosystem, as well as the adaptability and persistence of state-backed hacker groups like Chollima.

By weaponizing platforms developers trust, such as GitHub and NPM, the adversary demonstrates how the blending of technical sophistication with social engineering can enable deep and persistent access to corporate and individual targets alike.

Protecting Against Emerging Threats

Defensive strategies require heightened vigilance against unsolicited job interview offers, greater scrutiny of open-source packages, and robust endpoint monitoring for unusual command executions.

As the threat from highly targeted, socially engineered software supply chain attacks increases, organizations must foster security awareness among technical staff and invest in next-generation detection capabilities to stay ahead of evolving adversaries.

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates