HiSolutions researchers published analysis from a fall 2024 incident response investigation on HiSolutions Research in which a software developer's environment was compromised through an attack chain identical to the ongoing North Korea-linked "Contagious Interview" campaign. The investigation identified a more comprehensive sample of the Tsunami Framework — a modular malware relying on the TOR network and Pastebin for command-and-control — incorporating over 25 modules for credential theft, cryptocurrency mining, keylogging, and botnet functionality, with active development ongoing at time of publication.
Initial Access: BeaverTail to InvisibleFerret via GitHub
Initial access followed the documented Contagious Interview pattern: a malicious BeaverTail payload (loader) was chainloaded from the third-party domain api.npoint.io through a private GitHub repository. Upon execution, BeaverTail deployed the InvisibleFerret malware — consistent with the publicly known Contagious Interview kill chain targeting software developers. Analysis of the InvisibleFerret file .n2\bow identified a Python launcher with configuration parameters revealing the storage locations and execution logic for both the Tsunami Injector and Tsunami Installer. The actors also install a Python interpreter on the victim system to ensure version compatibility for their Python-based payload chain.
Tsunami Framework: 28-Module Architecture
The Tsunami client is a modular framework with the following components: Backdoor, Botnet, BraveCredentialStealer, BrowserCookie, BrowserCreditCard, BrowserPassword, BrowserSession, ChromeCredentialStealer, ChromiumStealer, CryptoMiner, DataStealer, Decryptor, DiscordAccount, EdgeCredentialStealer, EncryptedKey, EthereumMiner, ExodusStealer, FirefoxCredentialStealer, GeckoStealer, KeyLogger, InfoStealer, MoneroMiner, Nss3, OperaGXCredentialStealer, Profile, Secret, SecretFileStealer, TemperatureTracker, UpdateVisitor, and WinApi. The credential stealer modules cover all major browsers (Chrome, Chromium, Brave, Edge, Firefox/Gecko, Opera GX) as well as Discord accounts and the Exodus cryptocurrency wallet. The SecretFileStealer module is a notable recent addition — it searches for and uploads files matching conditions dynamically loaded from the C2 server, enabling operator-directed document collection without hardcoded file type filters. The Botnet module is anomalous for this malware class and appears to be in early development, not yet fully functional in the observed version.
TOR-Based C2 and Dual Cryptocurrency Mining
C2 communication is routed through a TOR .onion domain with nine documented API endpoints: /api/v1/browser-passwords, /api/v1/browser-sessions, /assets/v2/tsunami-client/file, /api/v1/discord-accounts, /api/v1/environment-info, /assets/v2/tsunami-client/hash, /api/v1/init, /api/v1/telemetry, and /assets/v2/dotnet6-installer-url. Pastebin accounts are used as an additional C2 channel. The Tsunami Installer deploys a full mining toolkit alongside the client: ETHW_Miner.exe for Ethereum mining, XMRig.exe with Xmrig_config.json and XMRig_Driver.sys for Monero mining, Tor.exe for C2 routing, AMD_Compute_Mode_Enabler.reg for GPU optimization, and Ldbdump.exe. The presence of 'rig-id': 'test' in the XMRig configuration indicates the framework remains in active testing and development at the time of the investigation.
Contagious Interview: Ongoing Cryptocurrency Theft Operations
The Contagious Interview campaign — a Lazarus operation targeting software developers through fake technical interview processes — continues to deliver tangible financial results through cryptocurrency theft. The Tsunami Framework represents the campaign's move toward more modular, resilient tooling with decentralized C2 infrastructure leveraging anonymization networks (TOR) and legitimate SaaS platforms (Pastebin, GitHub, npoint.io) to complicate infrastructure takedown and network-level detection. The combination of credential theft, session hijacking, Discord account compromise, Exodus wallet targeting, and dual-currency mining maximizes financial yield from each compromised developer environment.