Void Dokkaebi — Threat Actor Profile, Campaigns & Targets

Related Threat Clusters

Void Dokkaebi's Malware Campaign Exploits Developer Repositories via Fake Job Interviews
Void Dokkaebi, a North Korean threat actor, has escalated its malware distribution tactics by using fake job interviews to compromise software developers. This campaign, known as the 'Contagious Interview,' targets…

22 articles · Updated April 22, 2026
Cloud Atlas APT Group Exploits CVE-2018-0802 and Modifies termsrv.dll for RDP Access
The Cloud Atlas APT group has been observed employing a sophisticated cyber espionage campaign targeting government and commercial entities in Russia and Belarus. This campaign, active since 2025 and continuing into…

4 articles · Updated May 25, 2026
Void Dokkaebi Upgrades InvisibleFerret Malware to Evade Detection
The North Korea-linked threat group Void Dokkaebi has enhanced its InvisibleFerret malware by converting it from readable Python scripts to compiled binary modules (.pyd and .so files). This upgrade makes it more…

2 articles · Updated May 25, 2026

InvisibleFerret Malware Now Ships as .pyd and .so Files to Evade Script Detection — Cybersecuritynews · May 25, 2026
APT Group Patches termsrv.dll to Enable Multiple RDP Sessions — Gbhackers · May 25, 2026
InvisibleFerret Malware Uses .pyd and .so Files to Evade Script Detection — Gbhackers · May 25, 2026
DPRK Fake Job Scams Self-Propagate in 'Contagious Interview' — Darkreading · April 22, 2026
Void Dokkaebi Uses Fake Job Interview Lure to Spread Malware via Code Repositories — Trendmicro · April 22, 2026
Void Dokkaebi Uses Fake Job Interview Lure to Spread Malware via Code Repositories — Trendmicro · April 21, 2026

Cloud Atlas FAMOUS CHOLLIMA Malware Phishing Supply Chain Attack Trojan Worm Contagious Interview DataStax Neutralinojs Belarus North Korea