IT Professionals · 03/08/2023
Researchers from ReversingLabs and Sonatype discover a malicious package that mimics the VMware vSphere connector module ‘vConnector’, uploaded on the Python Package Index (PyPI) under the name ‘VMConnect,’ targeting IT professionals. [Date Occurred: 28/07/2023; Date Discovered: 28/07/2023]
Multiple organizations · 31/08/2023
Researchers from ReversingLabs discover three more malicious Python packages that are believed to be a continuation of the VMConnect campaign carried out by the North Korean Lazarus Group: tablediter, request-plus, and requestspro. [Date Occurred: Since at least early August 2023; Date Discovered: During early August 2023]
VMConnect supply chain attack continues, evidence points to North Korea · 2023-08-31T05:00:00.000Z
ReversingLabs researchers discovered more packages that are part of the previously identified VMConnect campaign, as well as evidence linking the campaign to North Korea's Lazarus Group. ... However, an analysis of the malicious packages used and their decrypted payloads reveals links to previous campaigns attributed to Labyrinth Chollima, an offshoot of Lazarus Group, a North Korean state-sponsored threat group.