InvisibleFerret Malware Uses .pyd and .so Files to Evade Script Detection

Gbhackers •Mayura Kathir • May 25, 2026

A North Korea-linked threat group, Void Dokkaebi, also known as Famous Chollima, has significantly upgraded its malware delivery techniques by converting its Python-based InvisibleFerret malware into compiled binary modules. InvisibleFerret was previously deployed as readable Python scripts, making it easier for defenders to detect through static analysis and signature-based tools. The latest campaign leverages Cython, […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Void Dokkaebi Upgrades InvisibleFerret Malware to Evade Detection The North Korea-linked threat group Void Dokkaebi has enhanced its InvisibleFerret malware by converting it from readable Python scripts to compiled binary modules (.pyd and .so files). This upgrade makes it more challenging for security tools to detect the malware through traditional static analysis methods. Previously, InvisibleFerret was easier to identify due to its script format, but the new delivery method leverages Cython to compile the code, increasing its stealth capabilities. The malware is primarily used for information theft and poses a significant risk to organizations that rely on signature-based detection methods. The campaign marks a notable evolution in the group's tactics, indicating a shift towards more sophisticated malware delivery mechanisms. Security professionals are advised to be vigilant and update their detection capabilities accordingly. 2 sources 73

Extracted Entities

InvisibleFerret Malware Uses .pyd and .so Files to Evade Script Detection

The full story

Extracted Entities

APT Groups (2)

Attack Types (1)

Countries (1)

Malware (1)

Platforms (1)