GCVE-VVD-OSM-2026-640

APT malware detected: invisible-ferret. Associated with threat actor(s): DPRK/Lazarus. Behaviors: network activity. Payload: lightmock/utils/loading.py Key findings: - Invisible Ferret Obfuscation in lightmock/utils/loading.py: "zlib').decompress(__import__('base64').b64decode(__[::-1]))" - Invisible Ferret Lambda Exec Pattern in lightmock/utils/loading.py: "_ = lambda __: __import__('zlib').decompress(__import__('base64').b64decode(__[:..." - Suspicious TLD Domain in lightmock/providers/address/bn_BD/__init__.py: "https://bdpost.portal.gov.bd" - Suspicious TLD Domain in lightmock/providers/address/en_BD/__init__.py: "https://bdpost.portal.gov.bd" - Suspicious Domain in lightmock/providers/address/es_ES/__init__.py: "https://administracionelectronica.gob" IOCs: - ipv4: 128.0.0.0, 192.0.0.0, 100.64.0.0, 192.0.2.0, 192.31.196.0 (+8 more) - ipv6: 1::, 6::, 2:: - urls: http://www.cupcakeipsum.com/, http://search.cpan.org/~jasonk/Data-Lightmock-0.07/, http://www.buildout.org/, http://sphinx-doc.org/, https://www.flake8rules.com/rules/E711.html (+45 more) - domains: www.cupcakeipsum.com, search.cpan.org, www.buildout.org, sphinx-doc.org, www.flake8rules.com (+45 more) - bitcoinAddresses: 1vb3z3wa6MPzyw6hkmNav1o1JNAuut - payloadFileHash: c973728e0c63f71b66cadd63627f2c3dcb82315b49e13ea73386541ef5e82066