VMConnect PyPI campaign (in "Threat research roundup: Lessons learned from recent PyPI and npm supply chain attacks")

Date (as written): 2023-09-05T05:00:00.000Z
Year: 2023
Actors (as written): Lazarus; Labyrinth Chollima
Actor pages: Lazarus Labyrinth Chollima
Tags (as written): PyPI

Source entries (2)

UN Panel of Experts S/2024/215

https://www.reversinglabs.com/blog/vmconnect-supply-chain-campaign-continues https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules · August

Annex 59: List of DPRK Cyberthreat actors’ malicious activities monitored by the Panel in 2023 (row 35 of 75, PDF p. 325). DPRK cyber actor: Lazarus Group; Report Name: https://www.reversinglabs.com/blog/vmconnect-supply-chain-campaign-continues https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules; Case Summary: A Lazarus Group supply chain campaign effected by posting dozens of malicious Python packages to an open-source Python software repository, which served as a distribution point for the malware. The packages reportedly mimicked popular open-source Python tools.; Publication Month: August

https://undocs.org/S/2024/215

ReversingLabs blog

VMConnect PyPI campaign (in "Threat research roundup: Lessons learned from recent PyPI and npm supply chain attacks") · 2023-09-05T05:00:00.000Z

This led to a second major discovery , which included not only the discovery of three more malicious packages found on PyPI, but also the attribution of the campaign onto a subset of the popular North Korean state-sponsored threat group Lazarus, known as Labyrinth Chollima.

https://www.reversinglabs.com/blog/threat-research-round-up-lessons-learned-from-recent-open-source-software-supply-chain-attacks

Suggest a correction on GitHub