SOSS Community Day Europe 2024

North Korea (DPRK) has been an active cyber threat since at least 2009. It is estimated that 90% of all DPRK cyber threat activity is attributable to a group under the Korean People's Army known as the Lazarus Group, which was responsible for the 2014 attack against Sony Pictures Entertainment. In June 2023, the Phylum Research Team discovered a series of suspicious packages published in the npm ecosystem. Upon installation, these packages facilitated the download of a malicious payload from a remote server. Later, GitHub published their independent findings, together with Microsoft Threat Intelligence and CISA, and confirmed that these packages were the work of the Lazarus Group. This campaign targeted software developers over three months. A new Lazarus Group campaign began in September 2023 with different and evolving tactics. Dozens of malicious packages were published during this time and were seen as recently as February 2024. The details in the code of these packages differ significantly, but a common motive between these two campaigns remains: stealing cryptocurrency from job-seeking software developers through social engineering.