{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "Developer workstations contain sensitive assets like API tokens and crypto wallets that are not protected by standard identity controls. A North Korean actor-led campaign specifically targeting these assets makes a negative result across the estate highly valuable." }, "name": "UNK_DeadDrop Credential and Crypto Wallet Theft", "type": "investigation", "labels": [ "hunt", "attack.t1041", "attack.t1071.001", "attack.t1090.003", "attack.t1555", "attack.t1070.004" ], "series": { "slug": "unk-deaddrop-phishing-campaign-targets-developers", "index": 2, "title": "UNK_DeadDrop phishing campaign targets developers", "total": 2 }, "related": [ { "hunt": "malicious-vsix-extension-persistence", "reason": "This hunt focuses on the post-infection actions of the RAT, while VSIX persistence is a separate mechanism needing module load analysis.", "relation": "out-of-scope-alternative" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "network": { "name": "Network telemetry", "category": "network", "telemetry": [ "network" ] }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A simple detection rule might fire on the Overlord binary name, but this hunt uses a phased approach to connect initial execution with later behavioral evidence of data exfiltration and anti-forensic cleanup, which provides the context necessary to distinguish a real intrusion from a lone suspicious file.", "coverage": [ { "stage": "credential-access-wallet-theft", "steps": [ "suspicious-overlord-processes", "evaluate-initial-infection" ], "status": "covered" }, { "stage": "c2-overlord-framework", "steps": [ "c2-infrastructure-lookup", "evaluate-initial-infection" ], "status": "covered" }, { "stage": "exfiltration-c2-channel", "steps": [ "exfiltration-traffic-patterns", "confirm-exfiltration-and-cleanup" ], "status": "covered" }, { "stage": "evasion-artifact-cleanup", "steps": [ "malicious-cleanup-actions", "confirm-exfiltration-and-cleanup" ], "status": "covered" }, { "stage": "initial-access-phishing-repo", "reason": "Belongs to another part of the 'UNK_DeadDrop phishing campaign targets developers' series.", "status": "out_of_scope" }, { "stage": "execution-ide-task-automation", "reason": "Belongs to another part of the 'UNK_DeadDrop phishing campaign targets developers' series.", "status": "out_of_scope" }, { "stage": "persistence-malicious-vsix", "reason": "Belongs to another part of the 'UNK_DeadDrop phishing campaign targets developers' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Phishing via Malicious GitHub Repository", "slug": "initial-access-phishing-repo", "tactic": "initial-access", "techniques": [ "T1566.002", "T1195.002" ], "observables": [ "github.com/Pulsynk/pulsynk", "github.com/Trixauvex-org/trixauvex", "github.com/sr-werney/forge-4626-invariants", "github.com/skyjum/x402-kit", "Themes: DeFi recruitment, code reviews, technical assignments" ] }, { "name": "Automated IDE Task Execution", "slug": "execution-ide-task-automation", "tactic": "execution", "techniques": [ "T1204.002", "T1059.004", "T1059.003" ], "observables": [ "tasks.json", "runoptions.runon: folderOpen", "vendor/run-update.sh", "vendor/run-update-hidden-launch.vbs", "wscript.exe //B //Nologo vendor/run-update-hidden-launch.vbs", "/bin/bash vendor/run-update.sh" ] }, { "name": "Malicious VSIX Extension Persistence", "slug": "persistence-malicious-vsix", "tactic": "persistence", "techniques": [ "T1546" ], "observables": [ "google-update-support VSIX extension", "google-update-support-darwin-arm64", "google-update-support-linux-amd64" ] }, { "name": "Browser and Wallet Credential Theft", "slug": "credential-access-wallet-theft", "tactic": "credential-access", "techniques": [ "T1555", "T1539" ], "observables": [ "Module: browserlogin", "Module: companywallet", "Accessing Chrome/Firefox profile data", "Targeting browser crypto wallet extensions" ] }, { "name": "C2 over Overlord Framework", "slug": "c2-overlord-framework", "tactic": "command-and-control", "techniques": [ "T1071.001", "T1090.003" ], "observables": [ "WebSocket persistent connectivity", "Hardcoded C&C servers", "Overlord C&C framework (Go-based)" ] }, { "name": "Exfiltration over C2", "slug": "exfiltration-c2-channel", "tactic": "exfiltration", "techniques": [ "T1041" ], "observables": [ "ZIP and upload of wallet data", "Exfiltration of browser credentials" ] }, { "name": "Anti-Forensic Artifact Cleanup", "slug": "evasion-artifact-cleanup", "tactic": "defense-evasion", "techniques": [ "T1070.004" ], "observables": [ "Module: cleanup", "Deletion of .vscode directory", "Deletion of vendor/ directory from cloned repo" ] } ], "summary": "The UNK_DeadDrop campaign by North Korean actors targets developers via phishing emails containing links to malicious GitHub repositories. When victims open these repositories in IDEs like VS Code or Cursor, automated tasks execute platform-specific loaders that install malicious extensions and Go-based or Node.js malware designed to steal cryptocurrency wallets and browser credentials." }, "severity": "high", "rationale": "Start with developer-heavy segments, particularly targeting DeFi or cryptocurrency-related projects. Use the identify-developer-hosts query to prioritize workstations with VS Code or Cursor IDEs installed.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "A developer has cloned a malicious repository that executed an Overlord-derived RAT to steal browser credentials and cryptocurrency wallets before cleaning up its own files.", "parameters": { "c2_domains": { "from": { "ref": "proofpoint-unk-deaddrop", "kind": "article", "observed": "2026-05-30" }, "type": "list[domain]", "default": [ "runoptions.runon" ], "description": "C2 domains identified in the research." }, "scope_hosts": { "from": { "ref": "analyst-scoping", "kind": "manual", "observed": "2026-05-30" }, "type": "list[host]", "default": [], "description": "Restrict the detection phase to the identified developer population." }, "lookback_days": { "from": { "ref": "hunt-standard", "kind": "manual", "observed": "2026-05-30" }, "type": "number", "default": "14", "description": "Days of history to examine." }, "malicious_binaries": { "from": { "ref": "proofpoint-unk-deaddrop", "kind": "article", "observed": "2026-05-30" }, "type": "list[string]", "default": [ "google-update-support-linux-amd64", "google-update-support-darwin-amd64", "google-update-support-darwin-arm64" ], "description": "Overlord framework binaries used in the campaign." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.proofpoint.com/us/blog/threat-insight/dont-fear-repo-unkdeaddrop-phishing-campaign-targets-developers-steal", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.proofpoint.com/us/blog/threat-insight/dont-fear-repo-unkdeaddrop-phishing-campaign-targets-developers-steal", "name": "Proofpoint \u2014 UNK_DeadDrop phishing campaign targets developers" } ], "blind_spots": [ { "id": "limited-file-telemetry", "risk": "Normal developer cleanup of old repositories could be mistaken for malware activity without process context for the deletion.", "stage": "evasion-artifact-cleanup", "question": "Whether the .vscode directory was deleted by the malware or the user.", "requires": "comprehensive hb_file_activity with delete events" }, { "id": "websocket-blindness", "risk": "The hunt can see that a connection exists, but not the specific modules (browserlogin/companywallet) being activated in real-time.", "stage": "c2-overlord-framework", "question": "What commands were sent over the Overlord WebSocket connection.", "requires": "deep packet inspection or WebSocket-aware network logs" } ] }, "name": "UNK_DeadDrop Credential and Crypto Wallet Theft", "description": "This hunt targets the final stages of the UNK_DeadDrop campaign, an operation attributed to North Korean threat actors. It identifies developer workstations using VS Code or Cursor, then searches for the execution of platform-specific Go binaries from the Overlord framework. The hunt pivots to find evidence of large data transfers and the automated deletion of workspace directories like .vscode and vendor, which the malware uses to hide its tracks. A phased approach ensures that early infection evidence is evaluated before weighing the high-volume exfiltration and cleanup activity to confirm a successful intrusion." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "unk-deaddrop-phishing-campaign-targets-developers", "index": 2, "title": "UNK_DeadDrop phishing campaign targets developers", "total": 2 }, "coverage": [ { "stage": "credential-access-wallet-theft", "steps": [ "suspicious-overlord-processes", "evaluate-initial-infection" ], "status": "covered" }, { "stage": "c2-overlord-framework", "steps": [ "c2-infrastructure-lookup", "evaluate-initial-infection" ], "status": "covered" }, { "stage": "exfiltration-c2-channel", "steps": [ "exfiltration-traffic-patterns", "confirm-exfiltration-and-cleanup" ], "status": "covered" }, { "stage": "evasion-artifact-cleanup", "steps": [ "malicious-cleanup-actions", "confirm-exfiltration-and-cleanup" ], "status": "covered" }, { "stage": "initial-access-phishing-repo", "reason": "Belongs to another part of the 'UNK_DeadDrop phishing campaign targets developers' series.", "status": "out_of_scope" }, { "stage": "execution-ide-task-automation", "reason": "Belongs to another part of the 'UNK_DeadDrop phishing campaign targets developers' series.", "status": "out_of_scope" }, { "stage": "persistence-malicious-vsix", "reason": "Belongs to another part of the 'UNK_DeadDrop phishing campaign targets developers' series.", "status": "out_of_scope" } ], "rationale": "A developer has cloned a malicious repository that executed an Overlord-derived RAT to steal browser credentials and cryptocurrency wallets before cleaning up its own files.", "blind_spots": [ { "id": "limited-file-telemetry", "risk": "Normal developer cleanup of old repositories could be mistaken for malware activity without process context for the deletion.", "stage": "evasion-artifact-cleanup", "question": "Whether the .vscode directory was deleted by the malware or the user.", "requires": "comprehensive hb_file_activity with delete events" }, { "id": "websocket-blindness", "risk": "The hunt can see that a connection exists, but not the specific modules (browserlogin/companywallet) being activated in real-time.", "stage": "c2-overlord-framework", "question": "What commands were sent over the Overlord WebSocket connection.", "requires": "deep packet inspection or WebSocket-aware network logs" } ], "scoping_notes": "Start with developer-heavy segments, particularly targeting DeFi or cryptocurrency-related projects. Use the identify-developer-hosts query to prioritize workstations with VS Code or Cursor IDEs installed.", "beyond_detection": "A simple detection rule might fire on the Overlord binary name, but this hunt uses a phased approach to connect initial execution with later behavioral evidence of data exfiltration and anti-forensic cleanup, which provides the context necessary to distinguish a real intrusion from a lone suspicious file." } }, { "id": "identify-developer-hosts", "type": "query", "label": "Identify developer hosts", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT DISTINCT device_hostname FROM hb_process_activity WHERE (LOWER(process_name) LIKE '%code%' OR LOWER(process_name) LIKE '%cursor%') AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Narrow the scope to hosts running developer tools like VS Code or Cursor to prioritize high-value targets.", "expected_signal": "A list of hostnames belonging to developers. Silence suggests no developer IDE activity was captured in the window." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Identify developer hosts", "reads": [ "device_hostname", "process_name", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT DISTINCT device_hostname FROM hb_process_activity WHERE (LOWER(process_name) LIKE '%code%' OR LOWER(process_name) LIKE '%cursor%') AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "A list of hostnames belonging to developers. Silence suggests no developer IDE activity was captured in the window.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "suspicious-overlord-processes", "type": "query", "label": "Suspicious Overlord processes", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, process_name, process_path, process_cmd_line, time FROM hb_process_activity WHERE instr(',' || '{{malicious_binaries}}' || ',', ',' || LOWER(process_name) || ',') > 0 AND (('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Find the execution of the specific Go-based Overlord binaries named in the research on developer hosts.", "expected_signal": "Specific binary names running from unexpected paths like /tmp/ or cloned repository folders." }, "parents": [ { "id": "identify-developer-hosts" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Suspicious Overlord processes", "reads": [ "device_hostname", "process_name", "process_path", "process_cmd_line", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, process_path, process_cmd_line, time FROM hb_process_activity WHERE instr(',' || '{{malicious_binaries}}' || ',', ',' || LOWER(process_name) || ',') > 0 AND (('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Specific binary names running from unexpected paths like /tmp/ or cloned repository folders.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "c2-infrastructure-lookup", "type": "query", "label": "C2 infrastructure lookup", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_hostname, query_hostname, process_name, time FROM hb_dns_activity WHERE instr(',' || '{{c2_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND (('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_dns_activity", "description": "Detect DNS queries to the hardcoded C2 domains used by the Overlord RAT from developer workstations.", "expected_signal": "The Overlord binary or a related process resolving the runoptions.runon domain." }, "parents": [ { "id": "identify-developer-hosts" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "C2 infrastructure lookup", "reads": [ "device_hostname", "query_hostname", "process_name", "time" ], "source": "hb_dns_activity", "target": "endpoint", "content": "SELECT device_hostname, query_hostname, process_name, time FROM hb_dns_activity WHERE instr(',' || '{{c2_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND (('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "The Overlord binary or a related process resolving the runoptions.runon domain.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "evaluate-initial-infection", "type": "analytic", "label": "Evaluate initial infection", "config": { "cite": "required", "tools": [ "endpoint", "network" ], "context": [ "suspicious-overlord-processes", "c2-infrastructure-lookup" ], "objective": "Determine if any host shows evidence of the Overlord RAT based on binary names and DNS traffic.", "description": "Analyze whether the process and DNS hits confirm the Overlord RAT is active.", "max_iterations": 4, "expected_signal": "A per-host verdict on whether the initial infection has occurred.", "success_criteria": "A suspicious or malicious verdict citing specific rows for at least one host." }, "parents": [ { "id": "suspicious-overlord-processes", "kind": "merge" }, { "id": "c2-infrastructure-lookup", "kind": "merge" } ] }, { "id": "exfiltration-traffic-patterns", "type": "query", "label": "Exfiltration traffic patterns", "config": { "dsl": "sqlite", "role": "baseline", "source": "network", "content": "SELECT device_hostname, process_name, dst_endpoint_ip, SUM(traffic_bytes) as total_bytes FROM hb_network_connection WHERE (('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, process_name, dst_endpoint_ip HAVING total_bytes > 10000000", "surface": "hb_network_connection", "description": "Find high-volume outbound network activity representing the exfiltration of wallet and credential data.", "expected_signal": "Outbound connections with significant aggregate traffic volume (ZIP uploads) from unexpected binaries." }, "parents": [ { "id": "evaluate-initial-infection" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Exfiltration traffic patterns", "reads": [ "device_hostname", "process_name", "dst_endpoint_ip", "traffic_bytes", "time" ], "source": "hb_network_connection", "target": "network", "content": "SELECT device_hostname, process_name, dst_endpoint_ip, SUM(traffic_bytes) as total_bytes FROM hb_network_connection WHERE (('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, process_name, dst_endpoint_ip HAVING total_bytes > 10000000", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "Outbound connections with significant aggregate traffic volume (ZIP uploads) from unexpected binaries.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "dst_endpoint_ip" ], "rare_below": 3 }, "verified_at": "2026-09-20" } }, { "id": "malicious-cleanup-actions", "type": "query", "label": "Malicious cleanup actions", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_hostname, file_path, process_name, time FROM hb_file_activity WHERE activity_id = 4 AND (LOWER(file_path) LIKE '%.vscode%' OR LOWER(file_path) LIKE '%\\\\.vscode%' OR LOWER(file_path) LIKE '%/vendor/%') AND (('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_file_activity", "description": "Identify the malware's attempts to hide its presence by deleting the .vscode and vendor directories on Windows, Linux, and macOS.", "expected_signal": "Deletions of configuration directories by non-IDE processes or the identified Overlord binary." }, "parents": [ { "id": "evaluate-initial-infection" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "Malicious cleanup actions", "reads": [ "device_hostname", "file_path", "process_name", "time", "activity_id" ], "source": "hb_file_activity", "target": "endpoint", "content": "SELECT device_hostname, file_path, process_name, time FROM hb_file_activity WHERE activity_id = 4 AND (LOWER(file_path) LIKE '%.vscode%' OR LOWER(file_path) LIKE '%\\\\.vscode%' OR LOWER(file_path) LIKE '%/vendor/%') AND (('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Deletions of configuration directories by non-IDE processes or the identified Overlord binary.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "confirm-exfiltration-and-cleanup", "type": "analytic", "label": "Confirm exfiltration and cleanup", "config": { "cite": "required", "tools": [ "endpoint", "network" ], "context": [ "evaluate-initial-infection", "exfiltration-traffic-patterns", "malicious-cleanup-actions" ], "objective": "Analyze the relationship between the Overlord RAT signals and the subsequent high-volume network traffic and workspace cleanup.", "description": "Synthesize early infection signals with exfiltration and cleanup evidence to confirm the full attack chain.", "max_iterations": 6, "expected_signal": "A high-confidence verdict for malicious activity where all stages of the chain are visible.", "success_criteria": "A malicious verdict for any host that shows infection followed by exfiltration or automated workspace deletion." }, "parents": [ { "id": "exfiltration-traffic-patterns", "kind": "merge" }, { "id": "malicious-cleanup-actions", "kind": "merge" } ] }, { "id": "remediation-route", "type": "checkpoint", "label": "Remediation route", "config": { "fuzzy": true, "judge": "hunter", "question": "the confirm-exfiltration-and-cleanup verdict is malicious for at least one host", "condition": "the confirm-exfiltration-and-cleanup verdict is malicious for at least one host", "blind_spot": "limited-file-telemetry", "confidence": "high", "description": "Route the hunt results based on the agent's confirmed intrusion verdict.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "confirm-exfiltration-and-cleanup" } ] }, { "id": "isolate-host", "type": "action", "label": "Isolate host", "config": { "target": "endpoint", "description": "Isolate the compromised developer workstation to prevent further data loss of crypto assets.", "instructions": "Isolate the identified host and collect memory and browser profile artifacts for forensic analysis.", "action_approval": "required" }, "parents": [ { "id": "remediation-route", "branch": "on_supports" } ] }, { "id": "manual-incident-response", "type": "task", "label": "Manual incident response", "config": { "assignee": "analyst", "description": "Provide a manual review task for cases where automation is insufficient.", "instructions": "Review the cited rows from the Overlord binaries, C2 DNS traffic, and exfiltration logs. Confirm the malicious nature of the IDE workspace cleanup." }, "parents": [ { "id": "remediation-route", "branch": "default" }, { "id": "remediation-route", "branch": "on_unavailable" }, { "id": "isolate-host" } ] }, { "id": "close-hunt", "type": "task", "label": "Close hunt", "config": { "assignee": "analyst", "description": "Log the findings and document any visibility gaps for future tuning.", "instructions": "Document the hosts found with UNK_DeadDrop indicators. Update the malicious_binaries and c2_domains lists with any new findings." }, "parents": [ { "id": "remediation-route", "branch": "on_refutes" }, { "id": "manual-incident-response" } ] } ] }