ShinyHunters attacks FBI, new WeaselBiscuit malware, Contagious Interview research, and dev FAQs

This week we discussed:  - **ShinyHunters vs. the FBI and Cl0p:** ShinyHunters claims it stole data from an FBI jobs website through a PeopleSoft zero-day, and it is threatening to leak that data unless the FBI retracts a May FLASH tied to the Instructure Canvas breach. We cover why aging enterprise monoliths like PeopleSoft and WebLogic are such attractive targets. We also get into the group's escalating public feud with ransomware crew Cl0p. - **A correction on WhatsApp Baileys attacks:** Malicious Baileys typosquats aren't targeting WhatsApp payments, as we said last week. We explain what these packages actually do and how threat actors make money from them. - **WeaselBiscuit:** A new, stripped-down, self-contained malware family derived from BeaverTail and OtterCookie has turned up in 16 npm packages so far. We share the latest on attribution, what the malware is designed to steal, and why its minimal design helps it slip past detection. - **FBI joint advisory on Contagious Interview:** The FBI and international partners issued a joint warning about the DPRK IT workers scam and Contagious Interview (under the name WaterPlum), with figures on infected devices and stolen cryptocurrency. We discuss what the advisory leaves out. We also explain why its finding of shared infrastructure with the IT workers scam matters for researchers and defenders. - **Atlassian's Contagious Interview research:** Atlassian published research on Contagious Interview activity across Bitbucket, GitLab, and GitHub, along with the actions it has taken on its own platform. We discuss what the report reveals about the campaign beyond GitHub and how platforms differ in responding to researcher reports. - **Developer questions from TikTok:** Our viral TikTok explainer on the VS Code tasks autorun technique drew a set of recurring questions from developers. We answer them, including "How this malware gets onto developer machines", "Whether signed commits or switching editors would stop it", "Why antivirus misses it", and "How researchers know North Korea is behind it." Episode resources: - (X) ShinyHunters statement on the FBI - (webpage) ShinyHunters - Cyber Criminal Group Attacks Learning Management System - (blog) ShinyHunters claims FBI hack, data theft in PeopleSoft zero-day breach - (feed) Baileys threat reports - (blog) WeaselBiscuit Strips BeaverTail and OtterCookie Down to Essentials - (PDF) North Korean "WaterPlum," commonly referred to as "Contagious Interview," Cyber Actor Group Targeting IT Professionals; Activities of North Korean IT Workers in Japan, the United States and Europe - (blog) From fake interviews to malicious repositories - Disrupting Contagious Interview - (TikTok) How the VS Code tasks autorun attack works