BeaverTail

MITRE ATT&CK: S1246 View on attack.mitre.org

Aliases: BeaverTail

First seen
2022-01-01 00:00:00
Malware type
credential-stealer, downloader
Family
Malware family
Operating systems
linux, macos, windows
Related IoCs
124 (74 malicious)
Last IoC activity
2026-10-17 02:09:35
Profile updated
2026-07-07 13:14:59

Targeted industries: government-and-public-sector technology-and-telecommunications

Targeted regions: country_code:kr country_code:us country_code:jp

Context

BeaverTail is a malware that has both a JavaScript and C++ variant. Active since 2022, BeaverTail is capable of stealing logins from browsers and serves as a downloader for second stage payloads. BeaverTail has previously been leveraged by North Korea-affiliated actors identified as DeceptiveDevelopment or Contagious Interview. BeaverTail has been delivered to victims through code repository sites and has been embedded within malicious attachments.

Recent IoC activity

74 malicious indicators in Maltiverse are attributed to BeaverTail (S1246). The 20 most recently updated:

TypeIndicatorUpdatedSources
hostname www.jsonkeeper.com 2026-10-17 2
hostname checking-ip-eight.vercel.app 2026-10-17 1
hostname ipregionchecker.org 2026-10-17 1
hostname api-server-mocha.vercel.app 2026-10-17 2
hostname a5lab.co 2026-10-17 1
hostname apigoogle-ashen.vercel.app 2026-10-17 1
hostname server-azure-tau.vercel.app 2026-10-16 1
hostname walter-server.vercel.app 2026-10-16 1
URL https://www.jsonkeeper.com/b/HTCVE 2026-10-15 2
hostname ip-vm.vercel.app 2026-10-14 2
URL https://ip-check-server.vercel.app/api/ip-check-encrypted/3aeb34a35 2026-10-13 2
hostname ip-check-server.vercel.app 2026-10-13 2
URL https://ip-check-api.vercel.app/api/ipcheck-encrypted/3aeb34a334834 2026-10-13 2
hostname ip-check-api.vercel.app 2026-10-13 2
IP address 45.61.150.67 2026-10-12 4
URL https://ipcheck-vm.vercel.app/api 2026-10-11 1
hostname y-lilac-sigma.vercel.app 2026-10-08 1
hostname serve-cookie.vercel.app 2026-10-07 1
hostname gd.tracelic.com 2026-10-07 1
hostname ipcheck-vm.vercel.app 2026-10-06 1

Detection coverage

  • 315 Sigma rules

Malware & tools used

  • Web Protocols (attack-pattern)
  • JavaScript (attack-pattern)
  • Credentials from Web Browsers (attack-pattern)
  • Exfiltration Over C2 Channel (attack-pattern)
  • Log Enumeration (attack-pattern)
  • Compromise Software Dependencies and Development Tools (attack-pattern)
  • Browser Information Discovery (attack-pattern)
  • System Information Discovery (attack-pattern)
  • Local Data Staging (attack-pattern)
  • Archive via Utility (attack-pattern)
  • Data from Local System (attack-pattern)
  • Encrypted/Encoded File (attack-pattern)
  • System Time Discovery (attack-pattern)
  • Non-Standard Port (attack-pattern)
  • Credentials from Password Stores (attack-pattern)
  • Malicious File (attack-pattern)
  • Junk Data (attack-pattern)
  • Ingress Tool Transfer (attack-pattern)
  • File and Directory Discovery (attack-pattern)
  • Masquerading (attack-pattern)
  • File Deletion (attack-pattern)
  • Financial Theft (attack-pattern)
  • Keychain (attack-pattern)

Used by threat actors

Reports & references

  • Palo Alto Unit 42 — North Korean Threat Actors Lure Tech Job Seekers As Fake Recruiters (report)
  • esentire.com — Bored Beavertail Invisibleferret Yacht Club A Lazarus Lure Pt 2 (report)
  • ESET — Deceptivedevelopment Targets Freelance Developers (report)
  • nimanthadeshappriya.com — From Colombo To Pyongyang (report)
  • blog.nviso.eu — Contagious Interview Actors Now Utilize Json Storage Services For Malware Delivery (report)
  • gitlab-com.gitlab.io — North Korean Malware Sept 2025 (report)
  • group-ib.com — Apt Lazarus Python Scripts (report)
  • Palo Alto Unit 42 — Two Campaigns By North Korea Bad Actors Target Job Hunters (report)
  • zscaler.com — Pyongyang Your Payroll Rise North Korean Remote Workers West (report)
  • MITRE ATT&CK — S1246 (report)
  • malpedia.caad.fkie.fraunhofer.de — Win.Beavertail (report)

External references