Lazarus APT: Techniques for Hunting Contagious Interview
Contents
Lazarus APT uses ClickFix social engineering to trick job seekers into executing malicious code, and Validin helps find related infrastructure and mitigate the threat.
Lazarus APT, a North Korean group, is using the ClickFix social engineering technique to trick job seekers into copying and pasting malicious code onto their devices during fake video job interviews ("Contagious Interview"). This blog post shows how to expand and pivot from threat intelligence using Validin to detect likely-related infrastructure and mitigate this threat.
Background
On December 28, 2024, a tweet by researcher @tayvano_ alerted the infosec community to a campaign using a talent recruitment theme to spread malware via ClickFix social engineering. The campaign was attributed to Lazarus APT due to similarities with Contagious Interview and domain registration patterns. This post describes how the initial alert led to a hunt for Lazarus APT ClickFix techniques using Validin to pivot from the initial indicators to identify more domains …
Lazarus APT, a North Korean group, is using the ClickFix social engineering technique to trick job seekers into copying and pasting malicious code onto their devices during fake video job interviews ("Contagious Interview"). This blog post shows how to expand and pivot from threat intelligence using Validin to detect likely-related infrastructure and mitigate this threat.
Background
On December 28, 2024, a tweet by researcher @tayvano_ alerted the infosec community to a campaign using a talent recruitment theme to spread malware via ClickFix social engineering. The campaign was attributed to Lazarus APT due to similarities with Contagious Interview and domain registration patterns. This post describes how the initial alert led to a hunt for Lazarus APT ClickFix techniques using Validin to pivot from the initial indicators to identify more domains …
IoC
http://intervu-talent.pro
http://cpanel.willorecruit.com
http://app.wtalents.us
http://webdisk.intro-crypto-assess.com
http://api.nvidia-release.org
http://interview.a-z+/
http://gemini.willohiring.com
http://app.videoforrecruitment.com
http://www.willohiringtalent.org
http://www.intro-crypto-assess.com
http://www.app.videoforrecruitment.com
http://d12rlkj8v5mwse.cloudfront.net
http://www.app.willoassessment.com
http://www.hiringinterview.org
http://www.hiringtalent.pro
http://www.willocandidate.com
http://cpcalendars.intro-crypto-assess.com
http://www.app.willotalents.org
http://app.hiringinterview.org
http://app.willotalents.org
http://gemini-willoassessment.com.willoassessment.com
http://www.willohiring.com
http://willointerview.com
http://www.gemini.willohiringtalent.org
http://www.willotalent.pro
http://www.robinhood.vinterview.org
http://www.willo-interview.us
http://www.geminiskill.willoassessment.com
http://www.app.videoscreening.org
http://talentcompetency.com
http://willotalent.pro
http://d20zx0lguyxj2p.cloudfront.net
http://video.com|us|org|pro/
http://www.gemini.willoassessment.com
http://www.app.willomexcvip.us
http://www.blockchain-assess.com
http://app.willoassessment.com
http://www.hiring.willoassessment.com
http://www.fundcandidates.com
http://api.nvidia-release.us
http://webmail.willorecruit.com
http://vid.intro-crypto-assess.com
http://www.talentassesspro.com
http://www.app.willotalent.us
http://www.api.willoassessment.com
http://www.willorecruit.com
http://app.willo-interview.us
http://gemini.willohiringtalent.org
http://webmail.complexassess.com
http://willohiringtalent.org
http://www.willomexcvip.us
http://www.app.blockchain-checkup.com
http://willo-interview.us
http://app.willorecruit.com
http://www.meta.willohiring.com
http://www.app.willohiring.com
http://mail.willorecruit.com
http://intro-crypto-assess.com
http://willomexcvip.us
http://mail.complexassess.com
http://www.talent.willoassess.com
http://willoassessment.com
http://api.wtalents.us
http://www.willoassess.org
http://willorecruit.com
http://www.app.willo-interview.us
http://crypto.a-z+/
http://mail.willomexcvip.us
http://www.gemini.willoassess.com
http://www.app.willocandidate.com
http://www.willotalentes.com
http://wilo-talent.com
http://app.willotalent.us
http://willotalents.org
http://d3o9p0hkd7eul5.cloudfront.net
http://cpcontacts.complexassess.com
http://www.robinhood.intro-crypto-assess.com
http://mail.wtalents.us
http://www.wilo-talent.com
http://mail.intro-crypto-assess.com
http://app.willotalentes.com
http://www.app.willotalent.xyz
http://willoassess.net
http://cpanel.wtalents.us
http://app.interviewnest.org
http://www.app.willotalent.pro
http://werhiring.willomexcvip.us
http://robinhood.vinterview.org
http://www.app.hiringinterview.org
http://www.consensys.willoassessment.com
http://final.hiringtalent.pro
http://www.api.nvidia-release.org
http://videoscreening.org
http://cpcalendars.complexassess.com
http://vinterview.org
http://wtalents.us
http://cpcontacts.willorecruit.com
http://complexassess.com
http://app.willohiringtalent.org
http://www.willotalent.us
http://www.werhiring.willomexcvip.us
http://www.complexassess.com
http://cpanel.complexassess.com
http://app.willotalent.xyz
http://www.vid.willoassess.com
http://app.willotalent.pro
http://fundcandidates.com
http://hiringinterview.org
http://vid.blockchain-assess.com
http://www.intervu-talent.pro
http://app.hiringtalent.pro
http://web.videoscreening.org
http://cpcontacts.intro-crypto-assess.com
http://www.vid.blockchain-assess.com
http://app.willoassess.com
http://willocandidates.com
http://api.willoassessment.com
http://app.blockchain-checkup.com
http://www.wtalents.us
http://willotalent.us
http://meta.willohiring.com
http://www.willointerview.com
http://23.254.244.74
http://keywords/app.(willo|wilo|hiring|blockchain|crypto
http://willovideorec.com
http://cpcalendars.willorecruit.com
http://gemini.willoassess.com
http://www.willo-video.com
http://blockchain-assess.com
http://interviewnest.org
http://webdisk.willorecruit.com
http://www.app.wtalents.us
http://willotalentes.com
http://vid.willoassess.com
http://www.web.videoscreening.org
http://www.gemini.willohiring.com
http://willohiring.com
http://www.app.willoassess.com
http://www.interviewnest.org
http://willocandidate.com
http://cpanel.intro-crypto-assess.com
http://www.vid.intro-crypto-assess.com
http://www.app.willohiringtalent.org
http://webdisk.complexassess.com
http://d1yzmjg018adwf.cloudfront.net
http://geminiskill.willoassessment.com
http://app.wilo-talent.com
http://app.willocandidate.com
http://hiring.willoassessment.com
http://app.willomexcvip.us
http://talentassesspro.com
http://www.talent.willo-interview.us
http://gemini.willoassessment.com
http://app.vinterview.org
http://www.app.vinterview.org
http://willo-video.com
http://webmail.intro-crypto-assess.com
http://videoforrecruitment.com
http://willoassess.com
http://app.blockchain-assess.com
http://www.app.interviewnest.org
http://www.app.willorecruit.com
http://app.willohiring.com
http://www.api.wtalents.us
http://wilio-talent.net
http://www.willoassess.com
http://www.talentcompetency.com
http://app.videoscreening.org
http://www.app.willotalentes.com
http://consensys.willoassessment.com
http://hiringtalent.pro
http://www.api.nvidia-release.us
http://autodiscover.complexassess.com
http://interview.com|us|org|pro/
http://www.gemini-willoassessment.com.willoassessment.com
http://www.tal.willoassess.com
http://willoassess.org
http://talent.willo-interview.us
http://www.app.blockchain-assess.com
23.254.244.74
531fbaedf67046d6904478f15d3e7142
http://cpanel.willorecruit.com
http://app.wtalents.us
http://webdisk.intro-crypto-assess.com
http://api.nvidia-release.org
http://interview.a-z+/
http://gemini.willohiring.com
http://app.videoforrecruitment.com
http://www.willohiringtalent.org
http://www.intro-crypto-assess.com
http://www.app.videoforrecruitment.com
http://d12rlkj8v5mwse.cloudfront.net
http://www.app.willoassessment.com
http://www.hiringinterview.org
http://www.hiringtalent.pro
http://www.willocandidate.com
http://cpcalendars.intro-crypto-assess.com
http://www.app.willotalents.org
http://app.hiringinterview.org
http://app.willotalents.org
http://gemini-willoassessment.com.willoassessment.com
http://www.willohiring.com
http://willointerview.com
http://www.gemini.willohiringtalent.org
http://www.willotalent.pro
http://www.robinhood.vinterview.org
http://www.willo-interview.us
http://www.geminiskill.willoassessment.com
http://www.app.videoscreening.org
http://talentcompetency.com
http://willotalent.pro
http://d20zx0lguyxj2p.cloudfront.net
http://video.com|us|org|pro/
http://www.gemini.willoassessment.com
http://www.app.willomexcvip.us
http://www.blockchain-assess.com
http://app.willoassessment.com
http://www.hiring.willoassessment.com
http://www.fundcandidates.com
http://api.nvidia-release.us
http://webmail.willorecruit.com
http://vid.intro-crypto-assess.com
http://www.talentassesspro.com
http://www.app.willotalent.us
http://www.api.willoassessment.com
http://www.willorecruit.com
http://app.willo-interview.us
http://gemini.willohiringtalent.org
http://webmail.complexassess.com
http://willohiringtalent.org
http://www.willomexcvip.us
http://www.app.blockchain-checkup.com
http://willo-interview.us
http://app.willorecruit.com
http://www.meta.willohiring.com
http://www.app.willohiring.com
http://mail.willorecruit.com
http://intro-crypto-assess.com
http://willomexcvip.us
http://mail.complexassess.com
http://www.talent.willoassess.com
http://willoassessment.com
http://api.wtalents.us
http://www.willoassess.org
http://willorecruit.com
http://www.app.willo-interview.us
http://crypto.a-z+/
http://mail.willomexcvip.us
http://www.gemini.willoassess.com
http://www.app.willocandidate.com
http://www.willotalentes.com
http://wilo-talent.com
http://app.willotalent.us
http://willotalents.org
http://d3o9p0hkd7eul5.cloudfront.net
http://cpcontacts.complexassess.com
http://www.robinhood.intro-crypto-assess.com
http://mail.wtalents.us
http://www.wilo-talent.com
http://mail.intro-crypto-assess.com
http://app.willotalentes.com
http://www.app.willotalent.xyz
http://willoassess.net
http://cpanel.wtalents.us
http://app.interviewnest.org
http://www.app.willotalent.pro
http://werhiring.willomexcvip.us
http://robinhood.vinterview.org
http://www.app.hiringinterview.org
http://www.consensys.willoassessment.com
http://final.hiringtalent.pro
http://www.api.nvidia-release.org
http://videoscreening.org
http://cpcalendars.complexassess.com
http://vinterview.org
http://wtalents.us
http://cpcontacts.willorecruit.com
http://complexassess.com
http://app.willohiringtalent.org
http://www.willotalent.us
http://www.werhiring.willomexcvip.us
http://www.complexassess.com
http://cpanel.complexassess.com
http://app.willotalent.xyz
http://www.vid.willoassess.com
http://app.willotalent.pro
http://fundcandidates.com
http://hiringinterview.org
http://vid.blockchain-assess.com
http://www.intervu-talent.pro
http://app.hiringtalent.pro
http://web.videoscreening.org
http://cpcontacts.intro-crypto-assess.com
http://www.vid.blockchain-assess.com
http://app.willoassess.com
http://willocandidates.com
http://api.willoassessment.com
http://app.blockchain-checkup.com
http://www.wtalents.us
http://willotalent.us
http://meta.willohiring.com
http://www.willointerview.com
http://23.254.244.74
http://keywords/app.(willo|wilo|hiring|blockchain|crypto
http://willovideorec.com
http://cpcalendars.willorecruit.com
http://gemini.willoassess.com
http://www.willo-video.com
http://blockchain-assess.com
http://interviewnest.org
http://webdisk.willorecruit.com
http://www.app.wtalents.us
http://willotalentes.com
http://vid.willoassess.com
http://www.web.videoscreening.org
http://www.gemini.willohiring.com
http://willohiring.com
http://www.app.willoassess.com
http://www.interviewnest.org
http://willocandidate.com
http://cpanel.intro-crypto-assess.com
http://www.vid.intro-crypto-assess.com
http://www.app.willohiringtalent.org
http://webdisk.complexassess.com
http://d1yzmjg018adwf.cloudfront.net
http://geminiskill.willoassessment.com
http://app.wilo-talent.com
http://app.willocandidate.com
http://hiring.willoassessment.com
http://app.willomexcvip.us
http://talentassesspro.com
http://www.talent.willo-interview.us
http://gemini.willoassessment.com
http://app.vinterview.org
http://www.app.vinterview.org
http://willo-video.com
http://webmail.intro-crypto-assess.com
http://videoforrecruitment.com
http://willoassess.com
http://app.blockchain-assess.com
http://www.app.interviewnest.org
http://www.app.willorecruit.com
http://app.willohiring.com
http://www.api.wtalents.us
http://wilio-talent.net
http://www.willoassess.com
http://www.talentcompetency.com
http://app.videoscreening.org
http://www.app.willotalentes.com
http://consensys.willoassessment.com
http://hiringtalent.pro
http://www.api.nvidia-release.us
http://autodiscover.complexassess.com
http://interview.com|us|org|pro/
http://www.gemini-willoassessment.com.willoassessment.com
http://www.tal.willoassess.com
http://willoassess.org
http://talent.willo-interview.us
http://www.app.blockchain-assess.com
23.254.244.74
531fbaedf67046d6904478f15d3e7142