Security alert: social engineering campaign targets technology industry employees · 2023-07
Security alert: social engineering campaign targets technology industry employees
https://github.blog/2023-07-18-security-alert-social-engineering-campaign-targets-technology-industry-employees/
Targeting of GitHub users with an interest in cryptocurrency · Jul 2023
North Korean threat actor Lazarus Group used spear-phishing lures to distribute GitHub repositories, usually pretending to be media players or cryptocurrency trading tools, which contain malicious code. The attacks share commonalities with another North Korean cyberattack detected in June 2022, TraderTraitor.
24th July – Threat Intelligence Report · 2023-07-24
Software development platform GitHub has found a social engineering campaign targeting technology firm employees on the platform. According to GitHub, North Korean APT group Lazarus aimed to gain users’ trust to ‘collaborate’ on a shared repository, which would deliver malware once run.
Developers in the blockchain, cryptocurrency, online gambling, and cybersecurity · 18/07/2023
GitHub warns of a social engineering campaign targeting the accounts of developers in the blockchain, cryptocurrency, online gambling, and cybersecurity sectors to infect their devices with malware. [Date Occurred: -; Date Discovered: -]
https://github.blog/2023-07-18-security-alert-social-engineering-campaign-targets-technology-industry-employees/#indicators · July
Annex 59: List of DPRK Cyberthreat actors’ malicious activities monitored by the Panel in 2023 (row 29 of 75, PDF p. 324). DPRK cyber actor: BlueNoroff; Report Name: https://github.blog/2023-07-18-security-alert-social-engineering-campaign-targets-technology-industry-employees/#indicators; Case Summary: A recent DPRK social engineering campaign perpetrated by BlueNoroff targets the personal accoun ts of employees of technology firms, using a combination of repository invitations and malicious npm package dependencies. Many of these targeted accounts are connected to the blockchain, cryptocurrency, or online gambling sectors.; Publication Month: July
“Security alert: social engineering campaign targets technology industry employees,” GitHub · 18 July 2023
Annex 99 (Select reports of DPRK cyber actors targeting the cryptocurrency industry), report 1: “Security alert: social engineering campaign targets technology industry employees,” GitHub, 18 July 2023. Summary: A recent DPRK social engineering campaign perpetrated by Bluenoroff targets the personal accounts of employees of technology firms, using a combination of repository invitations and malicious npm package dependencies. Many of these targeted accounts are connected to the blockchain, cryptocurrency, or online gambling sectors.
Jade Sleet GitHub repos and weaponized npm packages social engineering campaign · publication date not shown on page (covers activity since June 2023)
Jade Sleet used GitHub repos and weaponized npm packages in a social engineering spear-phishing campaign that targeted employees of cryptocurrency and technology organizations.
Social engineering campaign targeting tech employees spreading through npm malware · 2023-07-25T16:30:50.504Z
The Lazarus Group launched a sophisticated social engineering campaign targeting developers in the cryptocurrency and cybersecurity sectors, using compromised accounts and malware-laden NPM packages. ... This North Korean state-backed hacking syndicate, with known aliases like Jade Sleet and TraderTraitor, has been on the radar of several intelligence agencies, notably after the US government's exposé on their tactics in 2022. Their modus operandi involves compromising or fabricating GitHub accounts, luring professionals from sectors such as cryptocurrency, online gambling, and cybersecurity into seemingly benign collaborations.
Security alert: social engineering campaign targets technology industry employees · 2023-07-18T14:43:24+00:00
GitHub has identified a low-volume social engineering campaign that targets the personal accounts of employees of technology firms, using a combination of repository invitations and malicious npm package dependencies. Many of these targeted accounts are connected to the blockchain, cryptocurrency, or online gambling sectors. A few targets were also associated with the cybersecurity sector. ... We assess with high confidence that this campaign is associated with a group operating in support of North Korean objectives, known as Jade Sleet by Microsoft Threat Intelligence and TraderTraitor by the U.S. Cybersecurity and Infrastructure Security Agency (CISA).