S1245: InvisibleFerret
InvisibleFerret is a modular python malware that is leveraged for data exfiltration and remote access capabilities.[1][2][3] InvisibleFerret consists of four modules: main, payload, browser, and AnyDesk.[1] InvisibleFerret malware has been leveraged by North Korea-affiliated threat actors identified as DeceptiveDevelopment or Contagious Interview since 2023.[4][2][3][5] InvisibleFerret has historically been introduced to the victim environment through the use of the BeaverTail malware.[6][1][2][3][5]
Security context for executives and security teams
S1245: InvisibleFerret describes [InvisibleFerret](https://attack.mitre.org/software/S1245) is a modular python malware that is leveraged for data exfiltration and remote access capabilities.(Citation: ESET Contagious Interview BeaverTail InvisibleFerret February 2025)(Citation: Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024)(Citation: PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023) [InvisibleFerret](https://attack.mitre.org/software/S1245) consists of four modules: main, payload, browser, and AnyDesk.(...
Executive priority
S1245: InvisibleFerret is an official MITRE ATT&CK software. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.
Technical view
Security teams should validate S1245: InvisibleFerret by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (Linux, macOS, Windows), and available local telemetry before making detection or mitigation decisions.
Likely telemetry
- Official ATT&CK relationships and object metadata
- Network, endpoint, and security-tool telemetry
Detection direction
- Validate whether S1245: InvisibleFerret appears in your detection coverage and tabletop scenarios.
- Use the object to align executive risk language with SOC, incident response, and detection engineering work.
- Do not treat ATT&CK relationship context as attribution without corroborating evidence.
Mitigation priorities
- Map the object to existing controls and identify missing telemetry or response ownership.
- Prioritize mitigations that reduce exposure on the listed platforms and tactics.
- Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits
Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.
This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
InvisibleFerret
InvisibleFerret is a modular python malware that is leveraged for data exfiltration and remote access capabilities.[1][2][3] InvisibleFerret consists of four modules: main, payload, browser, and AnyDesk.[1] InvisibleFerret malware has been leveraged by North Korea-affiliated threat actors identified as DeceptiveDevelopment or Contagious Interview since 2023.[4][2][3][5] InvisibleFerret has historically been introduced to the victim environment through the use of the BeaverTail malware.[6][1][2][3][5]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1082 | System Information Discovery | InvisibleFerret has collected OS type, hostname and system version through the "pay" module.[6][1] InvisibleFerret has also queried the victim device using Python scripts to obtain the User and Hostname.[4][3] |
| Enterprise | T1657 | Financial Theft | InvisibleFerret has searched the victim device credentials and files commonly associated with cryptocurrency wallets.[6][1][2][3] |
| Enterprise | T1083 | File and Directory Discovery | InvisibleFerret has identified specific directories and files for exfiltration using the `ssh_upload` command which contains subcommands of `.sdira`, `sdir`, `sfile`, `sfinda`, `sfindr`, `sfind`.[1][2] InvisibleFerret also has the capability to scan and upload files of interest from multiple OS systems through the use of scripts that check file names, file extensions, and avoids certain path names.[6][3] InvisibleFerret has utilized the `findstr` on Windows or the macOS `find` commands to search for files of interest.[5] |
| Enterprise | T1056 | Input Capture | InvisibleFerret has collected mouse and keyboard events using “pyWinhook”.[3] |
| Enterprise | T1140 | Deobfuscate/Decode Files or Information | InvisibleFerret has decoded XOR-encrypted and Base-64-encoded payloads prior to execution.[1] |
| Enterprise | T1679 | Selective Exclusion | InvisibleFerret has the capability to scan for file names, file extensions, and avoids pre-designated path names and file types.[6][3] |
| Enterprise | T1105 | Ingress Tool Transfer | InvisibleFerret has downloaded “AnyDesk.exe” into the user’s home directory from the C2 server when checks for the service fail to identify its presence in the victim environment.[1] InvisibleFerret has also been configured to download additional payloads using a command which calls to the /bow URI.[2][3] |
| Enterprise | T1518 | Software Discovery | InvisibleFerret has gathered installed programs and running processes.[2] |
| Enterprise | T1057 | Process Discovery | InvisibleFerret has the capability to query installed programs and running processes.[2] InvisibleFerret has also identified running processes using the Python project “psutil”.[3] |
| Enterprise | T1056.001 | KeyloggingSub-technique | InvisibleFerret has conducted keylogging using the Python project “pyWinHook” and "Pyhook".[6][1][3] InvisibleFerret has also captured keylogging thread checks for changes in an active window and key presses.[2] |
| Enterprise | T1087.001 | Local AccountSub-technique | InvisibleFerret has queried the victim device using Python scripts to obtain the User and Hostname.[4][3] |
| Enterprise | T1555.003 | Credentials from Web BrowsersSub-technique | InvisibleFerret has stolen login data, autofill data, cryptocurrency wallets, and payment information saved in web browsers such as Chrome, Brave, Opera, Yandex and Edge, to include versions affiliated with major operating systems on Windows, Linux, and macOS.[6][1] InvisibleFerret has also leveraged the command `ssh_zcp` to copy browser data to include extensions and cryptocurrency wallet data.[2] |
| Enterprise | T1016 | System Network Configuration Discovery | InvisibleFerret has collected the local IP address, and external IP.[1][3] |
| Enterprise | T1489 | Service Stop | InvisibleFerret has terminated Chrome and Brave browsers using the `taskkill` command on Windows and the `killall` command on other systems such as Linux and macOS.[1] InvisibleFerret has also utilized it’s `ssh_kill` command to terminate Chrome and Brave browser processes.[3] |
| Enterprise | T1033 | System Owner/User Discovery | InvisibleFerret has identified the user’s UUID and username through the "pay" module.[6][1][3] |
| Enterprise | T1543.001 | Launch AgentSub-technique | InvisibleFerret has established persistence using LaunchAgents on macOS that run on Startup using a file named “com.avatar.update.wake.plist”.[2] |
| Enterprise | T1547.013 | XDG Autostart EntriesSub-technique | InvisibleFerret has established persistence within GNOME-based Linux environments by placing entries within `.desktop` that run on Startup.[2] |
| Enterprise | T1219 | Remote Access Tools | InvisibleFerret has utilized remote access software including AnyDesk client through the “adc” module.[6][1][3] InvisibleFerret has also downloaded the AnyDesk client should it not already exist on the compromised host by searching for `C:/Program Files(x86)/AnyDesk/AnyDesk.exe`.[2] |
| Enterprise | T1614 | System Location Discovery | InvisibleFerret has collected the internal IP address, IP geolocation information of the infected host and sends the data to a C2 server.[3] InvisibleFerret has also leveraged the “pay” module to obtain region name, country, city, zip code, ISP, latitude and longitude using “http://ip-api.com/json”.[1] |
| Enterprise | T1059.006 | PythonSub-technique | |
| Enterprise | T1564.003 | Hidden WindowSub-technique | InvisibleFerret has executed Python instances of the browser module “.n2/bow” utilizing the `CREATE_NO_WINDOW` process creation flag.[1] |
| Enterprise | T1571 | Non-Standard Port | InvisibleFerret has been observed utilizing HTTP communications to the C2 server over ports 1224, 2245 and 8637.[6] |
| Enterprise | T1041 | Exfiltration Over C2 Channel | InvisibleFerret has used HTTP communications to the “/Uploads” URI for file exfiltration.[2] |
| Enterprise | T1074.001 | Local Data StagingSub-technique | InvisibleFerret has staged data in consolidated folders prior to exfiltration.[1] |
| Enterprise | T1555.005 | Password ManagersSub-technique | InvisibleFerret has utilized the command `ssh_zcp` to exfiltrate data from browser extensions and password managers via Telegram and FTP.[1][2] |
| Enterprise | T1071.001 | Web ProtocolsSub-technique | InvisibleFerret has used HTTP for C2 communications.[6][1][3] |
| Enterprise | T1560.001 | Archive via UtilitySub-technique | InvisibleFerret has used 7zip, RAR and zip files to archive collected data for exfiltration.[1][2] |
| Enterprise | T1547.001 | Registry Run Keys / Startup FolderSub-technique | InvisibleFerret has established persistence within Windows devices by creating a .bat file “queue.bat” within the Startup folder to run a Python script.[2] |
| Enterprise | T1005 | Data from Local System | InvisibleFerret has collected data utilizing a script that contained a list of excluded files and directory names and naming patterns of interest such as environment and configuration files, documents, spreadsheets, and other files that contained the words secret, wallet, private, and password.[1] |
| Enterprise | T1115 | Clipboard Data | InvisibleFerret has stolen data from the clipboard using the Python project “pyperclip”.[6][1][3] InvisibleFerret has also captured clipboard contents during copy and paste operations.[2] |
| Enterprise | T1027.013 | Encrypted/Encoded FileSub-technique | InvisibleFerret has utilized the XOR and Base64 encoding for each of its modules.[1] InvisibleFerret has also obfuscated files with a combination of zlib, Base64 and reverse string order.[6] InvisibleFerret has also utilized the XOR and Base64 encoding some of its Python scripts.[3] |
| Enterprise | T1048.003 | Exfiltration Over Unencrypted Non-C2 ProtocolSub-technique | InvisibleFerret has used FTP to exfiltrate files and directories using the command `ssh_upload` which contains with six subcommands of `.sdira`, `sdir`, `sfile`, `sfinda`, `sfindr` and `sfind` that had varying functions.[1][2] InvisibleFerret has exfiltrated stolen files and data to the C2 servers over ports 1224, 2245 and 8637.[6] |
| Enterprise | T1095 | Non-Application Layer Protocol | InvisibleFerret has established a connection with the C2 server over TCP traffic.[3] InvisibleFerret has also created a TCP reverse shell communicating via a socket connection over ports 1245, 80, 2245, 3001, and 5000.[1] |
| Enterprise | T1567 | Exfiltration Over Web Service | InvisibleFerret has leveraged Telegram chat to upload stolen data using the Telegram API with a bot token.[1][2] |
| Enterprise | T1059.001 | PowerShellSub-technique | InvisibleFerret has utilized a PowerShell script created in the victim’s home directory named “conf.ps1” that is used to modify configuration files for AnyDesk remote services.[1] |
Groups, software, and campaigns
G1052: Contagious Interview
Contagious Interview is a North Korea–aligned threat group active since 2023. The group conducts both cyberespionage and financially motivated operations, including the theft of cryptocurrency and user credentials. Contagious Interview targets Windows, Linux, and macOS systems, with a particular focus on individuals engaged in software development and cryptocurrency-related activities. [1][2][3][4][5][6][7][8]
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(2)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.2 | 1.0 | Current bundle | 3fed931b84de… | ||
| 19.1 | 1.0 | Older bundle | 3fed931b84de… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]ESET Contagious Interview BeaverTail InvisibleFerret February 2025
Matej Havranek. (2025, February 20). DeceptiveDevelopment targets freelance developers. Retrieved October 17, 2025.
Open source URL - [2]Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024
Seongsu Park. (2024, November 4). From Pyongyang to Your Payroll: The Rise of North Korean Remote Workers in the West. Retrieved October 17, 2025.
Open source URL - [3]PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023
Unit 42. (2023, November 21). Hacking Employers and Seeking Employment: Two Job-Related Campaigns Bear Hallmarks of North Korean Threat Actors. Retrieved October 17, 2025.
Open source URL - [4]Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025
Insikt Group. (2025, February 13). Inside the Scam: North Korea’s IT Worker Threat. Retrieved October 17, 2025.
Open source URL - [5]PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024
Unit42. (2024, October 9). Contagious Interview: DPRK Threat Actors Lure Tech Industry Job Seekers to Install New Variants of BeaverTail and InvisibleFerret Malware. Retrieved October 17, 2025.
Open source URL - [6]Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024
eSentire Threat Response Unit (TRU). (2024, November 14). Bored BeaverTail & InvisibleFerret Yacht Club – A Lazarus Lure Pt.2. Retrieved October 17, 2025.
Open source URL - [7]mitre-attackS1245Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.