North Korea Targets Developers with The DEV#POPPER Campaign Again

Why Trust Tech Report

Tech Report is one of the oldest hardware, news, and tech review sites on the internet. We write helpful technology guides, unbiased product reviews, and report on the latest tech and crypto news. We maintain editorial independence and consider content quality and factual accuracy to be non-negotiable.

The infamous North Korea-based DEV#POPPER campaign that targets innocent developers around the world with fake job interviews is back once again and this time with an update.

This discovery was made by the Securonix Threat Research team who found during an analysis that the threat actors have added Linux and macOS variants (in addition to Windows) to the malware which means a much wider group of developers are now at risk.

Also, this malware campaign was previously limited to South Korea alone. But this time around, it’s targeting users from Europe, North America, and even the Middle East.

About the Attack

Here’s how the attack works:

Now the question is why are software developers being specifically targeted? That’s because software developers are one of the most valuable assets of a country.

For example, last November, North Korea’s primary cyberespionage and sabotage arm, the Lazarus Group, attacked a Taiwanese software company called CyberLink and infected an installer for its commercial apps.

These attacks can also be financially motivated. As per senior threat researcher Tim Peck, based on the type of malware that has been used, extortion could also be one of the causes.

Just last December, the North Korean hacker group APT37 group exploited a zero-day vulnerability in Internet Explorer to launch a cyberattack on South Korea.

How to Protect Yourself Against These Attacks?

Even having an antivirus on your system won’t save you. Too many obfuscation techniques such as Base64 encoding, dynamic function and variable names, concatenation and split strings, and prototyping obfuscation have been used that make detection next to impossible.

So the only thing that you can do is spread awareness and take some precautions. For example, if you are going for an interview, don’t do it from your company device.

Do your research on the company and job position and if anything seems out of the ordinary, take a step back. It’s not just for your company’s safety but also for your own. If your office device has any personal details, you are equally at risk.