North Korean Cybercriminals Target Developers with Deceptive npm Bundles
Individuals affiliated with North Korea have been identified releasing a series of harmful bundles to the npm registry, demonstrating “coordinated and persistent” attempts to aim at developers with harmful software and swipe digital money possessions.
The most recent series, which was detected between August 12 and 27, 2024, comprised of bundles named temp-etherscan-api, ethersscan-api, telegram-con, helmet-validate, and qq-console.
“The activities in this effort suggest that qq-console is connected to the North Korean operation recognized as ‘Contagious Interview,'” software supply chain security firm Phylum stated.
Contagious Interview alludes to a continuous operation that tries to compromise software developers using data-stealing malicious software as part of a supposed job interview process that involves deceiving them into downloading false npm bundles or counterfeit installers for video conferencing software like MiroTalk hosted on fake websites.
The ultimate aim of these cyber attacks is to put in place a Python payload termed InvisibleFerret that can move out sensitive information from virtual money wallet browser extensions and establish persistence on the system through authorized remote desktop software such as AnyDesk. CrowdStrike is following this action under the title Famous Chollima.
The recently detected helmet-validate bundle adopts a fresh strategy whereby it includes a part of JavaScript code file called config.js that directly executes JavaScript hosted on an external domain (“ipcheck[.]cloud”) using the eval() function.
“Our examination showed that ipcheck[.]cloud resolves to the same IP address (167[.]88[.]36[.]13) that mirotalk[.]net resolved to when it was active,” Phylum stated, pointing out possible connections between the two series of attacks.
The organization also noted another bundle called sass-notification that was uploaded on August 27, 2024, which exhibited resemblances with previously discovered npm libraries like call-blockflow. These bundles have been assigned to another North Korean threat faction known as Moonstone Sleet.
“These assaults are recognized by utilizing disguised JavaScript to compose and execute batch and PowerShell scripts,” it clarified. “The scripts fetch and decode a remote payload, execute it as a DLL, and then seek to erase all evidence of malicious activities, leaving behind an innocuous bundle on the victim’s device.”
Famous Chollima Assumes Roles as IT Operatives in U.S. Companies
This revelation comes as CrowdStrike linked Famous Chollima (previously BadClone) to insider threat operations that involve penetrating corporate setups under the guise of legitimate work.
“Famous Chollima carried out these operations by securing contract or full-time equivalent employment, utilizing forged or stolen identity papers to evade background assessments,” the company mentioned. “In their job applications, these malicious insiders submitted a CV typically indicating prior employment at a renowned company as well as additional less-known firms and no employment lapses.”
Although these attacks are largely financially driven, some of the occurrences are reported to involve the extraction of confidential details. CrowdStrike stated that it has recognized the threat actors applying to or actively functioning at over 100 distinct companies in the past year, with a majority situated in the United States, Saudi Arabia, France, the Philippines, and Ukraine, among other regions.
Majorly targeted sectors encompass technology, fintech, financial services, professional services, retail, transportation, manufacturing, insurance, pharmaceutical, social media, and media businesses.
“After gaining entry-level access to victim networks, the insiders conducted minimal activities related to their profession,” the company added. In a few instances, the insiders attempted data exfiltration using Git, SharePoint, and OneDrive.”
“Additionally, the insiders installed the following RMM tools: RustDesk, AnyDesk, TinyPilot, VS Code Dev Tunnels, and Google Chrome Remote Desktop. The insiders then employed these RMM tools along with company network credentials, enabling numerous IP addresses to connect to the victim’s system.”
About Author
