Veracode blog (incl. migrated Phylum research posts)
Lazarus npm social engineering campaigns 2023 (in Q4 2023 Evolution of Software Supply Chain Security Report) · 2024-01-22T20:47:00+00:00
Throughout the course of 2023, we continued to track the activities of the Lazarus group across several additional campaigns, with a new (but very similar) campaign emerging in Nov 2023, again publishing packages to npm as part of a social engineering campaign. ... In 2023, $3.8B of digital assets were stolen by attackers. According to Chainalysis, nearly 45% of this pilfered cryptocurrency was stolen by North Korean-backed operatives to sidestep imposed sanctions and further their weapons and nuclear programs.