InvisibleFerret

Description

InvisibleFerret is a modular Python malware that provides data exfiltration and remote access capabilities on infected systems. It consists of main, payload, browser, and AnyDesk modules, and North Korea affiliated threat actors have used it as part of the Contagious Interview campaign against job seekers.

Stats

First seen: August 2024
Last seen: September 2026

Also known as

Invisibleferret

MITRE ATT&CK techniques

35 techniques across 9 tactics.

TA0002 Execution

T1059Command and Scripting Interpreter
- T1059.006Python
- T1059.001PowerShell

TA0003 Persistence

T1543Create or Modify System Process
- T1543.001Launch Agent
T1547Boot or Logon Autostart Execution
- T1547.013XDG Autostart Entries
- T1547.001Registry Run Keys / Startup Folder

TA0005 Stealth

T1027Obfuscated Files or Information
- T1027.013Encrypted/Encoded File
T1140Deobfuscate/Decode Files or Information
T1564Hide Artifacts
- T1564.003Hidden Window
T1679Selective Exclusion

TA0006 Credential Access

T1555Credentials from Password Stores
- T1555.003Credentials from Web Browsers
- T1555.005Password Managers

TA0007 Discovery

T1016System Network Configuration Discovery
T1033System Owner/User Discovery
T1057Process Discovery
T1082System Information Discovery
T1083File and Directory Discovery
T1087Account Discovery
- T1087.001Local Account
T1518Software Discovery
T1614System Location Discovery

TA0009 Collection

T1005Data from Local System
T1056Input Capture
- T1056.001Keylogging
T1074Data Staged
- T1074.001Local Data Staging
T1115Clipboard Data
T1560Archive Collected Data
- T1560.001Archive via Utility

TA0011 Command and Control

T1071Application Layer Protocol
- T1071.001Web Protocols
T1095Non-Application Layer Protocol
T1105Ingress Tool Transfer
T1219Remote Access Tools
T1571Non-Standard Port

TA0010 Exfiltration

T1041Exfiltration Over C2 Channel
T1048Exfiltration Over Alternative Protocol
- T1048.003Exfiltration Over Unencrypted Non-C2 Protocol
T1567Exfiltration Over Web Service

TA0040 Impact

T1489Service Stop
T1657Financial Theft

Associated groups

G1052Contagious Interview

Alert name variants

Alert Name	Engine
Gen:Variant.InvisibleFerret.1	AV
Gen:Variant.InvisibleFerret.6	AV
Gen:Variant.InvisibleFerret.8	AV
MacOS.Spyware.InvisibleFerret	ATP Sandbox Adv. Heuristics
Script-Python.Backdoor.Invisibleferret	ATP Sandbox Adv. Heuristics
Script-Python.Backdoor.InvisibleFerret	ATP Sandbox Adv. Heuristics
Script-Python.Downloader.InvisibleFerret	ATP Sandbox Adv. Heuristics
Script-Python.Spyware.InvisibleFerret	ATP Sandbox Adv. Heuristics
Script-Python.Trojan.Invisibleferret	ATP Sandbox Adv. Heuristics
Script-Python.Trojan.InvisibleFerret	ATP Sandbox Adv. Heuristics
Win64.Backdoor.InvisibleFerret	ATP Sandbox Adv. Heuristics
Win64.Spyware.InvisibleFerret	ATP Sandbox Adv. Heuristics
Win64.Trojan.InvisibleFerret	ATP Sandbox Adv. Heuristics

Related families

TrickBot PlugX QakBot InvisiMole KONNI