Threat Analysis
PurpleBravo
The Contagious Interview campaign, first documented in November 2023, targeted software developers primarily in the cryptocurrency space and was attributed to North Korea. The campaign used the JavaScript infostealer BeaverTail, the cross-platform Python backdoor InvisibleFerret, and most recently OtterCookie, a new backdoor identified in December 2024. The group responsible for this activity is known as CL-STA-0240, Famous Chollima, and Tenacious Pungsan in open sources. Insikt Group has given this cluster of activity the designation PurpleBravo (formerly TAG-120).
PurpleBravo’s Fraudulent Profiles
On December 3, 2024, a developer posted a blog about their experience with a suspected PurpleBravo operator. An individual claiming to be a recruiter contacted them about a job offer and then followed up with an interview. During the interview, the interviewer asked the developer to download a coding challenge from a repository. The developer realized there was a malicious function in the file and ended the interview. While the developer does not attribute the malware or actor, Insikt Group assesses with high confidence the file is a BeaverTail infostealer.
The interviewer used a LinkedIn account with the name Javier Fiesco, who describes themself as the CTO of AgencyHill99. Further investigation into Javier Fiesco uncovered an individual with the same name available for work on remote3, a Web3 development job board. The website agencyhill99[.]com was registered on Hostinger on September 13, 2024. As of early February 2025, this website no longer resolved, but it previously displayed a Hostinger landing page. Research into AgencyHill99 uncovered a job posting seeking a developer with blockchain knowledge on levels[.]fyi, with the following contact info:
- Contact us: alexander@agencyhill99[.]com
- Recruiter: vision.founder1004@gmail[.]com
Pivoting on the text in the job description returned two private job postings on Upwork (1, 2). Additionally, a profile with the name of Lucifer, and what appears to be an AI-generated headshot, who works for AgencyHill99 was observed on the website DoraHacks, which is a hackathon, bounty, and grant organization. The profile on DoraHacks states that AgencyHill99 is looking to hire a developer. Insikt Group also discovered a company with the name Agencyhill99 on the website Intch, a part-time and remote job platform. The company posted a “Part-Time IT Developer Opportunity” by an individual with the name Newton Curtis, who is a recruiter at AgencyHill99.
Figure 1: PurpleBravo operator’s account on DoraHacks (Source: DoraHacks)
Insikt Group found several posts in Telegram channels from individuals with @agencyhill99[.]com email addresses advertising jobs. Below is a summary of the posts:
- On September 16, 2024, an account with the username Dale_V and email address ayat@agencyhill99[.]com posted in the Telegram channel “freelancerclients” that they were looking to hire a developer.
- On September 26, 2024, an account with the username jaxtonhol and email address ysai@agencyhill99[.]com posted in the Telegram channel “indeedemploijobeur” that they were looking to hire a developer. On the same day, the account Dale_V using the email ysai@agencyhill99[.]com posted in the Telegram channel “cryptolux_b” that they were looking to hire a blockchain developer. They posted the same message in the “itkita”, “andexzuxiaomichat”, and “usvacancy” channels. On September 27, 2024, Dale_V posted the same message in the “crypto_brazil” and “cryptolux_br” channels.
- On October 2, 2024, Dale_V posted the same message with a new email address, sam@agencyhill99[.]com, in the “fortifiedx_chat”, “family_indonesia_uae_ph”, “cryptolux_br”, and “freelancerclients” channels.
- On October 3, 2024, a user in an Indonesian-language Telegram channel posted a screenshot of an email message they received from PurpleBravo operators.
- On October 9, 2024, Dale_V posted job advertisements in the “andexzuxiaomichat”, “family_indonesia_uae_ph”, “cryptolux_br”, “crypto_brazil”, and “freelancerclients” channels.
- On October 22, 2024, Dale_V posted in the Telegram channel “hiringofm” seeking individuals to help maintain a game called Destiny War, and added the X link, hxxps://twitter[.]com/destinywarnft. It is unclear if the actor controls this X account or game.
- On November 13, 2024, the Telegram user jaxtonhol posted in the Telegram channel “near_jobs” seeking blockchain engineers. The same user posted again on December 7, 2024, in the same channel with the email address ysai@agencyhill99[.]com.
- On November 30, 2024, a Telegram user posted asking if a job offer on LinkedIn from the account mentioned above, Javier Feisco associated with Agencyhill99, was legitimate and shared a screenshot of the message.
GitHub Repository
Insikt Group discovered a GitHub repository named agencyhill99 with the email address admin@agencyhill99[.]com. A GitHub user, dev-astro-star, made several commits to the repository between October 9 and 19, 2024. Based on the commits, it appears the website used Firebase, a Google backend service for web applications. The user added a button to download a file at the Google Drive link https://drive.google[.]com/uc?id=166zcmpqj-C7NPltm4iwRolz8XuxqZIXt, which is no longer accessible. The email address admin@agencyhill99[.]com was also added to the repository, along with the Telegram channel hxxps://t[.]me/+2AurfGZWxZo0MDgx, which is also no longer live. The user also added a download link to hxxp://65.108.20[.]73/BattleTank[.]exe, which is no longer live and was later updated to hxxp://65.108.20[.]73[:]3000/BattleTank[.]exe. Port 3000 was open from October 20, 2024, to November 22, 2024, on 65.108.20[.]73. The link was then updated to hxxp://locahost[:]3000/BattleTank[.]rar.
PurpleBravo Malware and Infrastructure
PurpleBravo uses the malware families BeaverTail, InvisibleFerret, and OtterCookie. BeaverTail is a malware family initially distributed via NPM packages as a JavaScript payload and later as executables and downloaders targeting Windows and macOS environments. BeaverTail also acts as an infostealer, gathering cryptocurrency wallet and browser information. InvisibleFerret is a collection of post-compromise payloads that collectively act as a backdoor in victim environments. InvisibleFerret introduces additional malicious payloads into victim environments, performs information stealing and fingerprinting actions within the victim environment, and leverages legitimate protocols and software for C2 communications. Like InvisibleFerret, OtterCookie is a post-compromise malware family used as a backdoor, which establishes C2 connectivity via Socket[.]IO, receives and executes shell commands from C2 servers, and exfiltrates sensitive victim data.
Insikt Group analyzed BeaverTail, InvisibleFerret, and OtterCookie malware samples (See Appendix B for related file hashes). The BeaverTail samples were identified as PE variants targeting Windows environments. These samples included URLs linked to freeconference[.]com, a legitimate conferencing website, which aligns with Unit42’s findings of Contagious Interview payloads posing as FreeConference executables. The OtterCookie samples were two separate versions of the malware family; however, static analysis of these samples included strings that demonstrated both samples’ ability to gather and send system fingerprinting information to attacker C2 servers, including strings that indicated OtterCookie is capable of identifying cryptocurrency assets and sensitive information found in specific file types by using regex patterns, including executables, photos, and config and env files, among others.
The InvisibleFerret samples analyzed were Python scripts with the following functionalities:
- Determining victim device location via local IP address lookup
- Fingerprinting device details (user and hostname)
- Connecting to a Base64-encoded C2 address via HTTP POST requests
- Performing local directory discovery using hard-coded strings
- Creating a reverse shell for SSH session management and data exfiltration
- Copying clipboard data, keylogging, and tracking mouse movements.
Previous samples of InvisibleFerret were analyzed by Zscaler, which described a two-part infection chain in which the initial reconnaissance took place over HTTP traffic and FTP was used for data exfiltration, as shown in Figure 2.
Figure 2: InvisibleFerret Infection chain (Source: Recorded Future and Zscaler)
Insikt Group identified 21 PurpleBravo servers between August 2024 and February 2025 (see Appendix B for the complete list). The majority of servers use Tier[.]Net hosting, with Majestic Hosting, Stark Industries, Leaseweb Singapore, and Kaopu Cloud HK also being used in this campaign. Insikt Group has previously observed other North Korean threat groups favor many of these hosting providers. In addition to the C2 servers, using Recorded Future Network Intelligence, Insikt Group observed at least seven suspected victims between September 2024 and February 13, 2025. The victims are located in at least six countries, including the United Arab Emirates, Costa Rica, India, Vietnam, Türkiye, and South Korea. Open-source research identified Astrill VPN as a favored service by North Korean IT workers, with evidence that they use the service with remote administration tools. Insikt Group also observed network traffic between known Astrill VPN endpoints and PurpleBravo servers, corroborating this connection.
Figure 3: Location of PurpleBravo victims (Source: Recorded Future)
At least three victims in the cryptocurrency space were identified in the findings summarized below:
- On October 3, 2024, Insikt Group observed likely reconnaissance traffic between a BeaverTail C2 and a market-making company in the cryptocurrency space based in the United Arab Emirates. Shortly after the reconnaissance traffic, we observed likely exfiltration FTP traffic between the same IP addresses.
- On October 15, 2024, Insikt Group observed likely reconnaissance traffic between a BeaverTail C2 and a gambling company that offers online games and sells slot machines in the cryptocurrency space. The company is registered in Costa Rica. Reconnaissance traffic followed by FTP exfiltration traffic was observed between the C2 and the company’s infrastructure on November 25 and 26, 2024.
- On October 2, 2024, Insikt Group observed potential FTP exfiltration traffic between a BeaverTail C2 and a software development company based in India that builds blockchain, AI, and mobile, among other applications.
To read the entire analysis, click here to download the report as a PDF.