These packages, part of the broader Contagious Interview operation, are designed to evade automated detection systems and manual code audits, marking a significant evolution in the group’s approach to cyber espionage and financial theft. The Lazarus Group, a notorious North Korean state-sponsored hacking collective, has escalated its cyber warfare tactics by introducing new malicious npm packages with advanced obfuscation techniques. These packages share not only common C2 endpoints but also exhibit structural similarities with previously attributed Lazarus operations, including the use of BeaverTail, an infostealer targeting browser data, macOS keychain, and cryptocurrency wallets. The packages employ hexadecimal string encoding to hide critical strings such as function names, URLs, and command and control (C2) server addresses, making them less detectable during static analysis. The latest campaign has seen the Lazarus Group expand its presence in the npm ecosystem, publishing packages under new aliases like taras_lakhai, mvitalii, wishorn, and crouch626. As these cyber threats evolve, so must the defensive strategies of those in the software development community, ensuring that security is not just an afterthought but a fundamental aspect of the development process. Similarly, the wishorn account uses an obfuscated C2 IP address within its packages, linking it directly to known Lazarus infrastructure. In a strategic move to legitimize their operations, the Lazarus Group has shifted from GitHub to Bitbucket for hosting their malicious code. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. For instance, the package cln-logger uses this technique to decode strings like “require,” “axios,” and “get,” which are essential for fetching and executing code from C2 servers. This includes implementing automated dependency audits, contextual scanning of third-party packages, and monitoring for unusual dependency changes. The obfuscation strategy involves encoding strings in hexadecimal format, which are then decoded at runtime using JavaScript’s String.fromCharCode function reads the Socket report.
This Cyber News was published on cybersecuritynews.com. Publication date: Mon, 07 Apr 2025 11:30:10 +0000