Analyzing Void Dokkaebi’s Cython-Compiled InvisibleFerret Malware

Void Dokkaebi, a North Korea-linked threat group, has upgraded its InvisibleFerret malware to Cython-compiled binaries—making it far harder to detect—while expanding its info-stealing and cryptocurrency wallet targeting capabilities against developers and organizations with valuable credentials.