BeaverTail

{
  "id": "ATTACK:enterprise:S1246",
  "title": "BeaverTail",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S1246",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--6055aee2-d1c6-4877-94e9-a3bde9936470",
  "external_id": "S1246",
  "domain": "enterprise",
  "created": "2025-10-19T17:13:08.728Z",
  "modified": "2025-10-24T00:40:04.709Z",
  "version": "1.0",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024",
      "url": "https://www.esentire.com/blog/bored-beavertail-invisibleferret-yacht-club-a-lazarus-lure-pt-2"
    },
    {
      "source_name": "ESET Contagious Interview BeaverTail InvisibleFerret February 2025",
      "url": "https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/"
    },
    {
      "source_name": "Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024",
      "url": "https://www.zscaler.com/blogs/security-research/pyongyang-your-payroll-rise-north-korean-remote-workers-west"
    },
    {
      "source_name": "PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023",
      "url": "https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/"
    }
  ]
}