North Korean state-sponsored actors, identified as PurpleBravo and Chollima, are executing highly targeted social engineering campaigns against the IT software supply chain. Utilizing fake recruitment processes, attackers trick developers into executing malicious files disguised as technical coding assessments or job-related documentation. This campaign introduces PylangGhost, a Python-based evolution of the GolangGhost Remote Access Trojan (RAT), enabling cross-platform execution on both Windows and macOS. The deployment of these language-specific RATs facilitates long-term espionage, intellectual property theft, and lateral movement within sensitive development environments by leveraging the inherent trust in professional recruitment workflows and bypassing traditional detection through Go and Python implementations.

• Incident Overview: Recruitment-Based Social Engineering

  • Attackers masquerade as professional technical recruiters to establish rapport with high-value targets.
  • Campaigns specifically target IT professionals, software developers, and members of the software supply chain.
  • Attackers utilize psychological manipulation by simulating high-stakes technical interview environments.

• Attack Vector: Malicious Technical Assessments

  • Primary delivery mechanism involves malicious coding assignments sent during the interview stage.
  • Use of "clickfake" phishing documents and weaponized job-related technical documentation.
  • Payloads are embedded within files designed to mimic legitimate development tasks or software requirements.

• Malware Deep Dive: PylangGhost and GolangGhost

  • GolangGhost: A Go-based Remote Access Trojan (RAT) designed for stealthy command and control.
  • PylangGhost: A newly identified Python-based variant that enables expansion into macOS environments.
  • Cross-platform capability allows attackers to maintain persistence in heterogeneous development ecosystems.
  • Language-specific implementations (Go and Python) are utilized to evade traditional heuristic-based detection.

• Threat Group Profile and Impact

  • Threat Actors: Attributed to PurpleBravo and Chollima, entities associated with North Korean state interests.
  • Operational Objective: Targeted espionage and the theft of intellectual property from software development organizations.
  • Risk Profile: High risk of lateral movement within critical development environments and production infrastructure.

• Defensive Recommendations

  • Implement strict verification protocols for all external technical assessments and recruitment-related file transfers.
  • Enhance EDR/XDR monitoring to detect anomalous execution patterns in Python and Go environments.
  • Conduct specialized social engineering training for engineering teams regarding sophisticated recruitment scams.