North Korean Apt Lazarus Targets Developers With Malicious Npm Package
Thumbnail
Researchers have identified a malicious npm package named postcss-optimizer, linked to North Korean state-sponsored threat actors, specifically the Lazarus group. This package, which masquerades as a legitimate library, has been downloaded 477 times and contains the BeaverTail malware, functioning as both an infostealer and a loader. The malware targets developers across various operating systems, aiming to steal credentials and exfiltrate sensitive data. Affected: npm

Keypoints :

  • The malicious npm package is named postcss-optimizer.
  • It is associated with North Korean state-sponsored threat actors known as the Lazarus group.
  • The package has been downloaded 477 times.
  • It contains BeaverTail malware, which acts as both an infostealer and a loader.
  • The malware targets Windows, macOS, and Linux systems.
  • The threat actor uses social engineering tactics to persuade victims to install the malicious package.
  • Persistence is achieved through various methods, including registry modifications and script injections.
  • Malware exfiltrates sensitive data via HTTP POST requests to a command and control (C2) server.
  • The package remains live on npm despite its malicious nature.
  • Security measures such as dependency audits and automated scanning tools are recommended to mitigate risks.

MITRE Techniques :

  • T1195.002 — Supply Chain Compromise: Compromise Software Supply Chain
  • T1608.001 — Stage Capabilities: Upload Malware
  • T1204.002 — User Execution: Malicious File
  • T1059.007 — Command and Scripting Interpreter: JavaScript
  • T1059.006 — Command and Scripting Interpreter: Python
  • T1036.005 — Masquerading: Match Legitimate Name or Location
  • T1027.013 — Obfuscated Files or Information: Encrypted/Encoded File
  • T1546.016 — Event Triggered Execution: Installer Packages
  • T1048 — Exfiltration Over Alternative Protocol
  • T1583.006 — Acquire Infrastructure: Web Services
  • T1005 — Data from Local System
  • T1082 — System Information Discovery
  • T1083 — File and Directory Discovery
  • T1217 — Browser Information Discovery
  • T1555.003 — Credentials from Password Stores: Credentials from Web Browsers
  • T1555.001 — Credentials from Password Stores: Keychain
  • T1547.001 — Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
  • T1071.001 — Application Layer Protocol: Web Protocols
  • T1041 — Exfiltration Over C2 Channel
  • T1105 — Ingress Tool Transfer
  • T1119 — Automated Collection
  • T1657 — Financial Theft

Indicator of Compromise :

  • [domain] 91.92.120[.]132
  • [url] hxxp://91.92.120[.]132:80/client/xxx
  • [url] hxxp://91.92.120[.]132:80/pdown
  • [url] hxxp://91.92.120[.]132:80/uploads
  • [email] [email protected]

Full Research: https://socket.dev/blog/north-korean-apt-lazarus-targets-developers-with-malicious-npm-package