InvisibleFerret

Malware

11 incidents First seen 2025-12-18 Last seen 2026-10-02

Overview

                            
                             Highlight CTI
                        

InvisibleFerret is a modular python malware that is leveraged for data exfiltration and remote access capabilities. InvisibleFerret consists of four modules: main, payload, browser, and AnyDesk. InvisibleFerret malware has been leveraged by North Korea-affiliated threat actors identified as DeceptiveDevelopment or Contagious Interview since 2023. InvisibleFerret has historically been introduced to the victim environment through the use of the BeaverTail malware.

Investigate in CTI Graph Login required Open in Dashboard

Threat ecosystem

Actors Malware Campaigns CVEs

Tap a node for a quick look · double-tap to open its profile

At a glance

peak priority 170 40 techniques 1 groups use it LinuxmacOSWindows in ATT&CK since 2025-10-17 updated 2025-10-24 · v1.0

Activity by month (incidents)

2025-122026-10

Sectors targeted

cryptocurrency · 11technology · 7finance · 3government · 3defense · 1education · 1energy · 1retail · 1telecommunications · 1

Countries targeted

KP · 8JP · 6US · 6AU · 5DE · 5GB · 5AT · 4CH · 4CA · 3NL · 3NZ · 3BE · 2

Origin

KP · 11JP · 4US · 2AR · 1BO · 1BR · 1

Kinds of incident

State-Sponsored & Espionage · 7Malware & Botnets · 5Cyberattack (general) · 2Supply Chain · 2Data Breach · 1

Techniques seen in incidents

T1059.007 - JavaScript · 7T1588.001 - Malware · 6Espionage · 5T1059.006 - Python · 5Extortion · 3Impersonate · 3Keylogging · 3Social Engineering · 3T1555.001 - Keychain · 3Exfiltration · 2Impersonation · 1Lateral Movement · 1Phishing · 1Ransomware · 1

Related actors

Contagious Interview · 8Lazarus Group · 3Andariel · 1AppleJeus · 1

ATT&CK techniques by tactic (40)

execution T1059.001 PowerShell T1059.006 Python

persistence T1543.001 Launch Agent T1547.001 Registry Run Keys / Startup Folder T1547.013 XDG Autostart Entries

privilege escalation T1543.001 Launch Agent T1547.001 Registry Run Keys / Startup Folder T1547.013 XDG Autostart Entries

credential access T1056 Input Capture T1056.001 Keylogging T1555.003 Credentials from Web Browsers T1555.005 Password Managers

discovery T1016 System Network Configuration Discovery T1033 System Owner/User Discovery T1057 Process Discovery T1082 System Information Discovery T1083 File and Directory Discovery T1087.001 Local Account T1518 Software Discovery T1614 System Location Discovery

collection T1005 Data from Local System T1056 Input Capture T1056.001 Keylogging T1074.001 Local Data Staging T1115 Clipboard Data T1560.001 Archive via Utility

command and control T1071.001 Web Protocols T1095 Non-Application Layer Protocol T1105 Ingress Tool Transfer T1219 Remote Access Tools T1571 Non-Standard Port

exfiltration T1041 Exfiltration Over C2 Channel T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol T1567 Exfiltration Over Web Service

impact T1489 Service Stop T1657 Financial Theft

stealth T1027.013 Encrypted/Encoded File T1140 Deobfuscate/Decode Files or Information T1564.003 Hidden Window T1679 Selective Exclusion

Groups that use it

Contagious Interview