North_Koreas_Fur_Shop.pdf (12 MB)

North Korean fake-interview operations are described as delivery paths for BeaverTail, InvisibleFerret, OtterCookie, and ChaoticCapybara. The presentation analyzes those malware families, reverse-engineers their techniques, and modifies samples to expose details hidden inside related C2 infrastructure. The source supports tracking this activity as part of the Contagious Interview ecosystem, with the main defensive value in understanding how the tooling is implemented and how its infrastructure can be inspected.