✅ Report Title: Detailed Analysis of TraderTraitor's GopherGrabber Malware Observed in the Willo Campaign

The S2W Threat Intelligence Center has published an analysis report on the Willo Campaign, which is linked to the North Korea-backed APT group TraderTraitor. This report provides advanced threat intelligence on the GopherGrabber malware, which has been difficult to identify in previous cases.

✅ Executive Summary:

1) Supply Chain Attack
The malicious packages associated with the Willo Campaign were first distributed through the official NPM repository in June 2024.

• cors-app: A loader that imports the "cors-parser" package.
• cors-parser: A malicious package containing the index.js script responsible for executing the actual malicious activities.

2) Fake Installer
In July 2024, an installer disguised as the setup program for a service called "Versus X" was distributed, with GopherGrabber as the final payload. The S2W Threat Intelligence Center has identified and tracked GopherGrabber, a malicious code distributed as directly executable source code in the form of a Go project that can operate in a multi-platform environment and has backdoor and stealer functions that perform HTTP/S communication with a C2 server using MD5 hashing and RC4-encrypted packets.

3) Spear Phishing via LinkedIn
Since December 2024, an attack campaign has been distributing the GopherGrabber malware on LinkedIn by luring targets through job offers that lead to a video interview phishing page and tricking targets into executing malicious commands. This campaign is being tracked under the name Willo Campaign. The campaign has been identified as a targeted attack against employees in the cryptocurrency industry, including IT developers and sales managers.

4) Threat Actor
Multiple characteristics of the North Korea-based APT group TraderTraitor were observed in the malware distribution methods and attack objectives. However, a potential connection to UNC5221, a China-based APT group, may exist, as an SSL certificate used in the infrastructure matches that of WARPWIRE, a malware associated with UNC5221.

5) Impact
A cryptocurrency theft incident linked to the Willo Campaign has been reported, with total estimated losses amounting to approximately $64,020.

📌 What is the Willo Campaign?

Since December 2024, a widespread phishing campaign has been targeting employees in the cryptocurrency industry. To distribute the malware, the threat actors were observed using sophisticated social engineering techniques, such as offering targets jobs through job search platforms like LinkedIn, or tricking them into executing commands to download the malware via GitHub issue pages. They also created a phishing page impersonating the video interview platform Willo to avoid suspicion, distributing the malware only after targets answered questions related to the job interview.

📌 What are the specific details of the malicious installer and the GopherGrabber malware?

GopherGrabber is a malware distributed in the form of compressed project source code written in Go, which steals browser credentials and user information. It operates as a backdoor that performs HTTP/S communication with a C2 server using MD5 hashing and RC4-encrypted packets.

The S2W Threat Analysis Team identified an additional malicious installer, compiled on July 12, 2024, while investigating further threat intelligence related to the domain "api.jz-aws[.]info."

Although the exact distribution method of the installer file has not been identified, it was found that the malicious installer was distributed under the file name "VersusxSetup.exe," and the icon within the resource section of the installer matched that of the Versus X service. Considering that the official social media account of the service announced a closed beta test on July 11, this malware is assessed to have been designed to target users interested in the Versus X service.

When executed, the malicious installer downloads and installs Go on the infected device, drops embedded Go source code from the binary, and executes it. This infection method and the use of Go-based malware were later observed in the Willo Campaign as well. The executed Go source code was identified as malware with backdoor and stealer functionalities. The S2W Threat Analysis Team has named this malware family GopherGrabber and is actively tracking its activities.

✅ Threat Detection Recommendations and Mitigation Measures:

The contents of the report can be summarized into four categories as follows.

1) Threat Detail
The Willo Campaign refers to a phishing campaign targeting workers in the cryptocurrency industry, utilizing sophisticated social engineering techniques. It is primarily characterized by the use of the GopherGrabber malware, which is written in the Go programming language.

2) Activities
There are incidents of malware distribution through the official NPM package repository in June 2024 and the spread of GopherGrabber malware disguised as an installation file for the Versus X service in July 2024. However, widespread attack activities through phishing campaigns have sharply increased since December 2024.

3) Features
It has been confirmed that the malware samples distributed in this campaign have been circulating since around June 2024.

According to S2W's analysis, it is estimated that the malware was created by a different developer than the one responsible for the BeaverTail/InvisibleFerret malware, and it has therefore been classified as a separate malware cluster.

The malware samples used in the Willo Campaign are believed to be designed to operate across multiple platforms, including Windows and macOS, and significant efforts have been made to establish persistence mechanisms within the infection chain.

4) Threat Profile
The threat campaign discussed in this report is strongly assessed to be backed by the North Korean APT group TraderTraitor.

However, a weak association was also observed with the network infrastructure used by the WARPWIRE malware, which is linked to the Chinese APT group UNC5221.

Based on the alignment with previously known North Korean APT attack methods and objectives (TTPs), the activity is assessed with moderate confidence to be attributed to North Korea, while the possibility of a connection with a Chinese APT group cannot be ruled out.