- Security scientists discovered malicious code in NPM packages and GITHUB -OKS
- The code was attached to a Lazarus-operated account
- More than 200 victims were confirmed so far
Lazarus Group, a notorious North Korean state-sponsored threat actor, runs a campaign target software and web3 developers with “undetectable” malware.
CyberSecurity scientists at Strike from SecurityScorecard said the observed malware embedded in GitHub stocks and NPM packages where unsuspecting developers pick them up and integrate into their own projects.
The researchers said they saw the success friend Github profile known to be linked to Lazarus, which injects JavaScript implants in GitHub stocks where they merge with legitimate code. To make things worse, the profile has also committed benign code to better hide its malicious intention.
Financing of the State
Malware is distributed inside NPM packages, says Strike, who is “widely used” by cryptocurrency developers and web3 projects.
The researchers called the Marstech Mayhem campaign when malware was implemented is called Marstech1. Once inserted at the victim’s endpoint, it scans systems for Metamask, Exodus and Atomic Wallets that change browser configuration files to inject stealthy payload that can intercept transactions.
With that in mind, it is safe to say that Lazarus is still tasked with stealing cryptocurrency for the North Korean government. Previous reports said the government used the stolen crypto to finance its state apparatus as well as its nuclear weapons program.
So far, Strike managed to confirm at least 233 victims across the United States, Europe and Asia.
SecurityScorecard’s SVP for threat research and intelligence, Ryan Sherstobitoff said the Marstech1 implant comes with “layered veiling techniques” from control flow flatning and dynamic variable renam in JavaScript, to Multi-Stage Xor Development in Python.
He urged organizations and developers to adopt proactive security measures, continuously monitor their supply chain activities and integrate advanced threat information solutions to mitigate the risk of sophisticated attackers such as Lazarus.
