Dawn of Ninja Era: unmasking a malware distribution campaign linked to DPRK IT workers network

Thursday 15 October 16:30 - 17:00, Red room   

Naoki Takayama (Internet Initiative Japan)

In July 2026, we discovered and investigated a malware distribution campaign targeting online gamers and software developers in Japan. A threat actor group has leveraged a fake online game named "Ninja Era" as a lure, which has been conceived, designed, and developed using generative AI. Throughout diligent monitoring and analysis, we have obtained multiple related malware samples, insights from a data exfiltration platform, and even activity records of the threat actor group. By analysing the activity records, we have confirmed that the threat actor has a strong connection with the known DPRK IT workers network.

At the start of this talk, we outline the analysis of the "Ninja Era" game installer files and malicious payloads executed by them. The game installer executes multi-stage loader payloads, which leads to the execution of custom infostealer malware specifically targeting Telegram Messenger, and also modular .NET malware known as MoonPeak. Each payload observed was heavily obfuscated or encrypted, so we will showcase the methodologies used to analyse and extract IOCs including C2 server address. We will also showcase the comparison with the payload deployed by same threat actor group in past campaigns, which illustrates how threat actors evolve both their malware and TTPs as time progresses.

We will then discuss fake recruitment information posted by the threat actor on a Japanese crowdsourcing platform in August 2026. Fake recruitment information claimed that the development studio of "Ninja Era" was hiring software developers specialized in Solidity, Web3 Wallet, and smart contracts for developing an in-game economic system. We are highly confident that the purpose of this recruitment information was to lure job applicants to infect their computer with malware, based on conversations we observed between the threat actor and job applicants. We will provide an overview this fake recruitment campaign, alongside an analysis of documents, design data, and source codes hosted on the "Ninja Era" official website, which also contained malicious payloads executing MoonPeak.

Lastly, we will describe the threat group's background, characteristics of their attack flow, and internals of their infrastructure. We reveal how individuals engaged in the malware distribution campaign alongside activity as DPRK IT workers to gain illicit earnings. We have also identified the commonalities of payloads and infrastructures operated by the threat group, allowing us to pivot multiple in-the-wild malware samples with strong correlation. By analysing them in detail, we will showcase an effective countermeasures and detection methodologies, helping the audience to defend against similar attack campaigns. Moreover, we will introduce an analysis of the admin panel hosted on "Ninja Era" official website, revealing how the threat actor manages victims and exfiltrated data from Telegram Messenger.

Naoki Takayama Naoki Takayama is a security researcher at Internet Initiative Japan, Inc. He specializes in reverse engineering, malware analysis, and digital forensics. As a member of IIJ-SECT, the private CSIRT of his company, he is engaged in threat research and incident response. His research focuses on malware and tactics used in APT campaigns targeting East Asia. He has spoken at multiple cybersecurity conferences including BSides Tokyo, FIRSTCON, JSAC and Virus Bulletin in the past. @mopisec

Back to VB2026 Programme page

Back to VB2026 conference page

Register for VB2026

Other VB2026 papers