“Analysis of attack samples suspected of Lazarus (APT-Q-1) involving npm package supply chain,” QiAnXin Threat Intelligence Center · 7 December 2023
Annex 99 (Select reports of DPRK cyber actors targeting the cryptocurrency industry), report 13: “Analysis of attack samples suspected of Lazarus (APT-Q-1) involving npm package supply chain,” QiAnXin Threat Intelligence Center, 7 December 2023. Summary: A batch of Lazarus Group downloader samples were recently discovered ... one of the C2 server IP addresses ... was reportedly recently disclosed by the Phylum Research Team as used by the Lazarus Group in a software supply chain attack, in which the malware was delivered disguised as an encryption-related npm package.
Analysis of Suspected Lazarus (APT-Q-1) Attack Sample Targeting npm Package Supply Chain · 2023-12-08T18:54:17.000Z
Lazarus is an APT group with suspected Northeast Asian origins, internally tracked by QiAnXin with the code APT-Q-1. This group gained widespread attention starting from the 2014 attack on Sony Pictures, with its earliest known activities dating back to 2007. Initially focusing on government institutions to steal sensitive intelligence, Lazarus shifted its targets after 2014 to include global financial institutions, virtual currency exchanges, and conducted attacks with financial gain as the objective. Additionally, the group targeted security researchers. In recent years, Lazarus has frequently initiated software supply chain attacks, with the 3CX supply chain attack event in the first half of this year believed to be attributed to this group.