Lazarus Hackers Group Not a Single APT But Comprises Multiple Sub-Groups

The notorious Lazarus Group, a North Korean state-sponsored Advanced Persistent Threat (APT) actor, has intensified its campaign against developers and cryptocurrency wallets through sophisticated supply chain attacks.

Recent discoveries by cybersecurity researchers reveal the deployment of malicious npm packages designed to infiltrate developer workflows and exfiltrate sensitive data.

Background on Lazarus Group

Active since at least 2009, Lazarus Group has been linked to financial theft, cyber espionage, and sabotage.

Its operations have targeted global financial institutions, government entities, and private organizations.

The group’s latest tactics demonstrate significant adaptability in exploiting vulnerabilities within modern software supply chains.

Recent Discoveries: Malicious npm Packages

Cybersecurity firm Socket recently uncovered six malicious npm packages embedded with BeaverTail malware.

These packages—is-buffer-validator, yoojae-validator, event-handle-package, array-empty-validator, react-event-dependency, and auth-validator—were collectively downloaded over 330 times before their removal from GitHub.

The malware employs typosquatting techniques, mimicking trusted libraries to deceive developers into integrating harmful code into their projects.

Once installed, the BeaverTail malware executes multi-stage payloads, including reconnaissance, persistence mechanisms, and data exfiltration.

It specifically targets cryptocurrency wallets by extracting sensitive files id.json from Solana wallets and exodus. wallet Exodus wallets.

These files are then transmitted to hardcoded command-and-control (C2) servers.

Technical Insights: Code-Level Obfuscation

The malicious packages leverage advanced obfuscation techniques to evade detection:

• Self-invoking functions and dynamic function constructors obscure the code’s functionality.
• Array shifting further complicates analysis.
• The malware operates on unconventional ports using Node.js Express backends for C2 communication.

The second-stage payload often includes InvisibleFerret, a potent backdoor aligned with Lazarus’ historical supply chain exploitation methods.

This demonstrates the group’s commitment to operational stealth and adaptability in implant development.

Targeted Campaigns

The campaign, dubbed Operation Marstech Mayhe,m highlights Lazarus Group’s focus on developers in the cryptocurrency and Web3 sectors.

By leveraging legitimate GitHub profiles and npm repositories, the group aims to distribute malware widely through trusted open-source channels.

Researchers have also identified connections between these activities and previous campaigns like Operation, a fake recruitment scheme targeting freelance developers.

Case Study: Moonstone Sleet Subgroup

One subgroup of Lazarus, Moonstone Sleet, has been actively targeting cryptocurrency businesses and defense industries.

It employs similar tactics by contacting engineers on LinkedIn or other social platforms to lure them into downloading malicious Python or npm packages via PyPI or GitHub.

These packages often deploy malware like Comebacker and PondRAT for initial compromise.

Detection Strategies: YARA Rules

To combat these threats, cybersecurity teams recommend implementing YARA rules for detecting malicious files associated with Lazarus Group activities.

Below is an example of a simplified YARA rule for identifying BeaverTail malware:

textrule BeaverTail_Malware {
    meta:
        description = "Detects BeaverTail malware used by Lazarus Group"
        author = "Socket Researchers"
        date = "2025-03-31"
    strings:
        $string1 = "id.json"
        $string2 = "exodus.wallet"
        $c2_server = "http://malicious-c2.com"
    condition:
        any of ($string1, $string2) or $c2_server
}

This rule scans for specific indicators such as stolen wallet files or hardcoded C2 domains.

Lazarus Group’s evolving tactics underscore the growing threat of supply chain attacks in software development environments.

By exploiting open-source repositories like npm and GitHub, the group aims to infiltrate developer workflows and compromise downstream users.

Organizations must remain vigilant by implementing robust detection mechanisms, sharing threat intelligence, and securing their digital ecosystems against such sophisticated adversaries.

As Lazarus continues refining its methods, cybersecurity professionals must adapt their defenses to counter this persistent threat effectively.

Also Read: