UN Panel of Experts S/2024/215
疑似 Lazarus（ APT-Q-1）涉及 npm 包供应链 的攻击样本分析 · December
Annex 59: List of DPRK Cyberthreat actors’ malicious activities monitored by the Panel in 2023 (row 68 of 75, PDF p. 330). DPRK cyber actor: Lazarus Group; Report Name: 疑似 Lazarus（ APT-Q-1）涉及 npm 包供应链 的攻击样本分析; Case Summary: A batch of Lazarus Group downloader samples was recently discovered, which are loaded through multiple layers of nested PE files and ultimately download a payload from a C2 server and execute it. Of note, one of the C2 server IP addresses was used by the Lazarus Group in a software supply chain attack, in which the malware was delivered disguised as an encryption-related npm package. Several of the C2 addresses identified appear to be linked to the cryptocurrency industry.; Publication Month: December