2024-10-14 Lazarus InvisibleFerret.pdf

This report provides a detailed analysis of the Lazarus group's 'InvisibleFerret' malware campaign: a Python-based downloader that deploys a backdoor, browser infostealer, and Windows keylogger, using heavy obfuscation and automated pip installs; it documents C2 servers, attack capabilities (keylogging, credential and card theft, remote control, exfiltration via FTP/API), and supplies MD5 hashes and URLs as IOCs for detection and response.