Threats
Vulnerabilities and patches
Breaches and privacy
Research
World
Learn
Monday 2 November
Global

Your region, kept on this device.

Get the appSign in

DeceptiveDevelopment

Threat actor

Names and who uses them

  • DeceptiveDevelopmentOur name
  • Contagious InterviewMITRE ATT&CK
  • DEV#POPPERMITRE ATT&CK
  • Tenacious PungsanMITRE ATT&CK
  • PurpleBravoRecorded Future
  • TAG-121Recorded Future
  • Gwisin GangSentinelOne

Targets

Sectors: Cryptocurrency

Source: MITRE ATT&CK

Known techniques

  • T1027.010Command Obfuscation
  • T1027.013Encrypted/Encoded File
  • T1036Masquerading
  • T1041Exfiltration Over C2 Channel
  • T1048.003Exfiltration Over Unencrypted Non-C2 Protocol
  • T1059.003Windows Command Shell
  • T1059.004Unix Shell
  • T1059.005Visual Basic
  • T1059.006Python
  • T1059.007JavaScript
  • T1070.004File Deletion
  • T1071.003Mail Protocols
  • T1082System Information Discovery
  • T1083File and Directory Discovery
  • T1090Proxy
  • T1204.001Malicious Link
  • T1204.002Malicious File
  • T1204.004Malicious Copy and Paste
  • T1204.005Malicious Library
  • T1219.002Remote Desktop Software
  • T1480Execution Guardrails
  • T1497Virtualization/Sandbox Evasion
  • T1543.001Launch Agent
  • T1546.004Unix Shell Configuration Modification
  • T1547.001Registry Run Keys / Startup Folder
  • T1547.013XDG Autostart Entries
  • T1555.001Keychain
  • T1566.003Spearphishing via Service
  • T1567Exfiltration Over Web Service
  • T1567.002Exfiltration to Cloud Storage
  • T1571Non-Standard Port
  • T1573.001Symmetric Cryptography
  • T1583Acquire Infrastructure
  • T1583.001Domains
  • T1583.003Virtual Private Server
  • T1583.006Web Services
  • T1585Establish Accounts
  • T1585.001Social Media Accounts
  • T1585.002Email Accounts
  • T1587Develop Capabilities
Source: MITRE ATT&CK

Malware and tools used

BeaverTailHexEval LoaderInvisibleFerretXORIndex Loader
Source: MITRE ATT&CK

Security timeline

  1. Activity reported by Cyber Security NewsDeceptiveDevelopment hackers steal developer credentials to poison GitHub repositories and software packages

Recent news

Cyber Security News· · High

DeceptiveDevelopment hackers steal developer credentials to poison GitHub repositories and software packages

ESET reports that , a North Korea-aligned group, used stolen Git credentials, SSH keys and tokens between April and September 2026 to alter public and private repositories, often rewriting commit history. Poisoned code appeared on npm, the Go module mirror, Packagist, PyPI and browser extension marketplaces, and the group deployed the OmniStealer infostealer and the DEVPOPPER remote access trojan.

Am I affected?
Ask
1