The notorious North Korean state-backed hacking group Lazarus uploaded four packages to the Python Package Index (PyPI) repository with the goal of infecting developer systems with malware.
The packages, now taken down, are pycryptoenv, pycryptoconf, quasarlib, and swapmempool. They have been collectively downloaded 3,269 times, with pycryptoconf accounting for the most downloads at 1,351.
The disclosure comes days after Phylum uncovered several rogue packages on the npm registry that have been used to single out software developers as part of a campaign codenamed Contagious Interview.
The attack sequence then uses NTUSER.DAT to load and execute IconCache.db, a malware called Comebacker that’s responsible for establishing connections with a command-and-control (C2) server to fetch and run a Windows executable file.
JPCERT/CC said the packages are a continuation of a campaign that Phylum first detailed in November 2023 as leveraging crypto-themed npm modules to deliver Comebacker.
“Attackers may be targeting users’ typos to have the malware downloaded,” Tomonaga said. “When you install modules and other kinds of software in your development environment, please do so carefully to avoid installing unwanted packages.”
Source: https://thehackernews.com/
