GitLab Threat Intelligence Team reveals North Korean tradecraft

This post details the identification and analysis of North Korean nation-state threat actors using GitLab.com to distribute malware via fake technical interview projects. It describes the 'Contagious Interview' campaign, the malware infrastructure used (JavaScript codebases, Vercel hosting, custom domains), and specific execution patterns involving base64 encoded URLs, trigger functions, and custom error handlers that execute remote code. The post also highlights the use of VS Code tasks for malware execution and the observation of distinct, parallel operational teams.