North Korea targets crypto developers via NPM supply chain attack

North Korea has changed tack: its latest campaign targets the NPM registry and owners of Exodus and Atomic cryptocurrency wallets. Carrying out a financially motivated string of attacks isn't the news here – North Korea's primary objective has long been to siphon money from enemy economies. The fresh finding is a JavaScript implant that hides itself in GitHub repositories and node package manager (NPM) packages typically used by crypto devs. According to SecurityScorecard's research, 233 individual victims have been confirmed thus far after installing the new Marstech1 implant, many features of which demonstrate North Korea's evolving tradecraft. Asked for more details about the victims, the vendor said it had none. Given Web3 developers' reliance on NPM and Marstech1's ability to evade detection using static and dynamic analyses, SecurityScorecard said the campaign presented a real danger to cryptocurrency developers. A supply chain risk exists since the compromised software packages could be downloaded and unwittingly introduced into applications, potentially compromising many more users. Marstech1 uses command and control (C2) infrastructure that communicates over port 3000 rather than 1224 or 1245, and lacks features of previous Lazarus campaigns such as the React web panel as seen in the recent Phantom Circuit attack. Lazarus is a cybercrime group allegedly run by the North Korean government. Marstech1's capabilities primarily involve targeting cryptocurrency wallets acr...