Threat Actors unk_deaddrop

unk_deaddrop

TLP:CLEAR

Active

Kill Chain Analysis Generate Graph Hunt Package

Also known as: tracked as

Description

unk_deaddrop’s campaign blended social engineering with exploitation of trusted development workflows. Attackers crafted convincing recruitment and code‑review emails that linked to actor‑controlled GitHub, GitLab or BitBucket repositories. Once a victim cloned the repository into Visual Studio Code or a compatible editor, an embedded .vscode/tasks.json silently executed a shell script that installed a malicious VSIX extension. The extension then launched a Go‑based RAT (Overlord) on macOS and Linux and a Node.js/Python pipeline on Windows. The malware conducted system reconnaissance, stole API keys, crypto wallet information, and browser credentials from Chromium‑based browsers and Firefox, and exfiltrated the data in encrypted ZIP archives to a WebSocket C2 server at 23.137.105.75:5173. The actor leveraged attacker‑controlled domains bought through Namecheap and email services such as Mailgun, Vercel, and email hosts with .xyz and .ink TLDs. Payloads were obfuscated with Base64 or AES‑256 encryption, while a self‑cleanup routine deleted cloned repositories and temporary files to reduce forensic evidence. Persistence was achieved by re‑executing the RAT if stopped and, on macOS, modifying keychain ACLs to run with elevated privileges. This operation exemplifies how modern threat actors can turn legitimate development tools into vectors for credential theft and financial gain while keeping a low profile through stealthy deployment methods.

Goals & Targeting

Targeted Sectors

Financial services

Education

Government

Media

Healthcare

Retail

Hospitality

Targeted Countries / Regions

United States of America

AI Analysis

Grounded in web research

· analyzed in 12 chunks · 1 week ago

Executive Summary

unk_deaddrop, an actor with probable North‑Korean ties, executed a large‑scale phishing operation in April–May 2026 that targeted software developers across finance, crypto, education and technology sectors. By using fake job offers and code‑review lures to deliver malicious GitHub repositories containing VSIX extensions and hidden task files, the group installed cross‑platform malware that stole cryptocurrency wallet credentials and browser data while maintaining persistence through deceptive editor plugins.

Goals & Targeting

The primary objective of unk_deaddrop appears to be monetisation via the acquisition of cryptocurrency wallet credentials and general developer credentials. By targeting organisations in finance, education, government, media, healthcare, retail, hospitality, and specifically within crypto‑related domains, the actor seeks both direct financial gain and potential future leverage for other operations such as ransomware or intellectual property theft. The focus on developers indicates a desire to exploit privileged access and insider information, maximizing return with minimal effort.

Enhanced Description

Key Capabilities

Spearphishing emails targeting software developers
Fake recruitment or coding assignment lures in emails
Delivery of malicious code via GitHub/GitLab/BitBucket repositories
Exploitation of trusted development tools (VS Code, Cursor)
Malicious VSIX extensions that auto‑execute on folder open
Hidden .vscode/tasks.json scripts that silently trigger payload deployment
Cross‑platform malware execution using the Overlord Go framework and Node.js/Python agent
Credential theft of cryptocurrency wallets, browser passwords, and API tokens
System reconnaissance and persistence via VSIX and auto‑relaunch scripts
Anti‑forensic self‑cleanup (deleting cloned repos and temporary files)
Command and control through WebSocket/Dead Drop Resolver to a fixed IP
Obfuscation and encryption of payloads to evade detection

MITRE ATT&CK Tactics

Initial Access

Execution

Command and Control

Credential Access

Persistence

Collection

Exfiltration

Defense Evasion

Privilege Escalation

Discovery

Reconnaissance

Resource Development

Stealth

Defense Impairment

Lateral Movement

Impact

ATT&CK Techniques

T1566.001

T1102.001

T1071

T1566.002

T1204

T1041

T1070

T1192

T1105

T1059.003

T1059

T1064

T1071.004

T1053

T1555.003

T1003

T1547.001

T1552.003

T1068

T1490

T1074

T1059.006

T1071.001

T1070.004

T1059.004

T1027

Software / Tooling

GitHub

Visual Studio Code (VS Code)

npm

Overlord Go framework

Overlord RAT

Node.js agent

.vscode/tasks.json

VSIX extension

WScript hidden execution

Pulsynk

Trixauvex

forge-4626-invariants

x402-kit

Campaigns & Victims

unk_deaddrop ran a sustained operation between April and May 2026, targeting nearly one hundred organisations worldwide. The attacker capitalised on the trust communities built around open‑source projects and development environments, using attractive coding assignments to lure developers into cloning malicious repositories. The operational tempo was rapid: the phishing emails were mass‑distributed via email accounts on Mailgun and other services, while the delivery infrastructure (GitHub repos, Vercel hosts) allowed quick takedown evasion. Victims predominantly came from finance, crypto exchange, and education sectors—groups with valuable digital assets. Past operations by similar North‑Korean threat actors have mirrored this mix of social engineering, repository exploitation, and cryptocurrency theft.

IOC Patterns

Phishing emails with fake job offers or coding assignments
Malicious GitHub repository links embedded in emails
Use of trusted development tools to download/run malware
Command and Control via Dead Drop Resolver or WebSocket endpoint
Credential theft targeting cryptocurrency wallet credentials
Hidden .vscode/tasks.json executing shell or cmd scripts upon project open
Base64‑encoded embedded payloads
Encrypted C2 traffic (AES 256)
Self‑deletion of cloned repository directories after execution
Use of attacker-owned sender domain names and domains bought via Namecheap

Recommended Actions

Implement advanced email filtering to block phishing campaigns targeting developers, including scrutiny of job offer attachments and links.
Enforce multi‑factor authentication on all developer accounts and code repository services.
Deploy application whitelisting that blocks installation of unknown VSIX extensions or .vscode/tasks.json scripts from untrusted sources.
Educate development teams about social engineering tactics such as fake recruitment emails and the risks of cloning unknown repositories.
Monitor network traffic for outbound WebSocket connections to known C2 IPs (e.g., 23.137.105.75) and block unauthorized exfiltration channels.
Enable endpoint detection and response solutions that detect silent execution via WScript, hidden vbs scripts, or suspicious Go/Python binaries.
Audit and purge compromised email sender domains and ensure email servers use reputation services.
Configure OS integrity monitoring to flag modifications to keychain ACLs on macOS or VSS snapshot creation.
Restrict automatic VS Code/Cursor task execution unless explicitly trusted by a developer.
Regularly patch development tools, runtimes (Node.js, Python), and operating systems to eliminate known vulnerabilities.

Suggested Tags

developer_targeting

phishing

GitHub_exploitation

VSIX_extension

North_Korea

cryptocurrency_theft

credential_stealer

credential_access

spearphishing

social_engineering

malicious_repositories

command_and_control

cross_platform_malware

overlord_rat

nodejs_pipeline

python_agent

websocket_c2

anti_forensics

credential_theft

wallet_stealer

Sources

Confidence Assessment

The analysis is based on a substantial body of publicly available intelligence from multiple reputable sources, including detailed technical reports, threat‑intel blogs, and open‑source code repositories. Confidence in the actor’s North‑Korean affiliation and use of VSIX-based delivery is high, given corroborated evidence across several publications. However, gaps remain regarding precise attribution methodology, the full extent of financial gains, and whether the campaign continued beyond May 2026. Some technical details (e.g., exact command structure inside tasks.json) are inferred from similar campaigns.