The Lazarus hacker group, believed to be based in North Korea, has been targeting the personal accounts of technology firms through a series of low-profile social engineering attacks. In this campaign, the threat actor combines repository invitations with a malicious npm package to target victims who are associated with blockchain, cryptocurrency, or online gambling sectors. Though no GitHub or npm system accounts were compromised in this campaign, it is still important for individuals and companies in the technology industry to remain vigilant.
According to GitHub, this specific campaign is linked to a group known as Jade Sleet as identified by Microsoft Threat Intelligence, and TraderTraitor as identified by the U.S. Cybersecurity and Infrastructure Security Agency (CISA). While the exact motives behind these attacks are unclear, it is essential for technology industry employees to be aware of the tactics used by the Lazarus Group.
The Lazarus Group’s attack process typically starts with the threat actors creating professional profiles on websites like GitHub and other social media platforms. They may impersonate developers or recruiters to gain the trust of their targets. Additionally, the group may utilize both personal and compromised accounts to contact victims. Oftentimes, the initial contact takes place on one platform and then switches to another during the course of conversation.
Once connected with a target, the threat actor invites them to collaborate on a GitHub repository and manipulates them into cloning and executing its contents. In some cases, the threat actor may skip the invitation process and send the malicious software directly through a messaging or file-sharing service. The GitHub source code contains malicious npm dependencies, such as media players and tools for selling cryptocurrencies. These malicious npm packages download second-stage malware onto the victim’s computer.
To combat this campaign, GitHub has suspended npm and GitHub accounts associated with the Lazarus Group. The platform has also provided Indicators of Compromise (IOCs) on their blog to help individuals and organizations protect themselves. It is crucial to exercise caution when receiving social media solicitations to collaborate on or install npm packages or software that depends on them.
Remaining up-to-date with the latest cybersecurity news is essential in the fight against malicious actors like the Lazarus Group. By following cybersecurity news sources on Google News, LinkedIn, Twitter, and Facebook, individuals and companies can stay informed about emerging threats and best practices for protection. Vigilance and knowledge are key in staying one step ahead of cyber attacks.