Multiple organizations · 31/07/2024
Researchers from Datadog reveal that the North Korea-linked threat actor known as Moonstone Sleet has continued to push malicious npm packages to the JavaScript package registry with the aim of infecting Windows systems. [Date Occurred: 07/07/2024; Date Discovered: 07/07/2024]
Stressed Pungsan: DPRK-aligned threat actor leverages npm for initial access · 2024-07-31T00:00:00Z
The tactics, techniques, and procedures (TTPs) behind the malicious packages, C2 infrastructure, and targeting sets align closely with what Microsoft calls MOONSTONE SLEET, an actor aligned with the Democratic People’s Republic of Korea (DPRK, also referred to as North Korea). ... During regular scanning and triage operations, we discovered two packages that share infrastructure, tactics, techniques & procedures with the Democratic People’s Republic of Korea (DPRK) aligned actors.