Lazarus Group ramps up Linux developer attacks with fake recruiter lures and poisoned npm, PyPI, and GitHub packages
𝕏 •
Revision history
2 recorded changes
Want your article here?
Promote with Leviathan NewsDPRK's Lazarus Group is escalating attacks on Linux-using developers and IT staff, leaning on fake recruiter outreach and malicious coding challenges to drop malware during sham interviews. The operation spans npm, PyPI, and GitHub, where poisoned packages and staged repos act as supply-chain beachheads into downstream projects. Researchers are telling devs to treat every unsolicited "opportunity" as hostile, enable SELinux or AppArmor, and sandbox any code from untrusted sources before running it.
TLDR by @Benthic
More coverage
- Lazarus Group Targets Developers Through NPM Packages and ... (securityscorecard.com)
- Lazarus Group (APT38) Explained: Timeline, TTPs, and Major Attacks (picussecurity.com)
- The Lazarus Group (APT38): North Korean Threat Actor - Radware (radware.com)
- Lazarus Group | Bugcrowd (bugcrowd.com)
- [PDF] How North Korea-Backed Lazarus Group Is Weaponizing Open ... (sonatype.com)
Explore the topic
More on Lazarus
Lazarus Group has stolen $6B in crypto since 2017 as North Korea drives 70% of 2026 exploits
info.arkm ·
Security analyst reveals how Lazarus Group uses a macOS malware kit “Mach-O Man,” luring victims via fake Zoom and Google Meet links to execute malicious commands and gain full system access
𝕏/@officer_secret ·
LayerZero attributes KelpDAO exploit with Lazarus Group. RPC probably the culprit
𝕏/@layerzero_core ·
Live Footage Exposes Lazarus Group’s Covert IT-Worker Pipeline Targeting U.S. Finance and Crypto Firms in a State-Backed Espionage and Funding Scheme
any.run ·
Changpeng Zhao has warned that North Korean hackers use fake job postings, insider hires, and phishing tactics to infiltrate top crypto firms and steal user funds. He pointed to recent hacks tied to Lazarus Group and others, including a $400M breach allegedly linked to Coinbase’s outsourced customer support.
crypto.news ·
North Korea’s Lazarus Group has been linked to a $23M hack on UK crypto startup Lykke, involving 158 BTC and 2,161 ETH. The stolen crypto was laundered via DAI swaps and dispersed across multiple wallets, according to ongoing investigations.
Cryptonews ·
Lazarus Group has stolen $6B in crypto since 2017 as North Korea drives 70% of 2026 exploits
info.arkm ·
Security analyst reveals how Lazarus Group uses a macOS malware kit “Mach-O Man,” luring victims via fake Zoom and Google Meet links to execute malicious commands and gain full system access
𝕏/@officer_secret ·
LayerZero attributes KelpDAO exploit with Lazarus Group. RPC probably the culprit
𝕏/@layerzero_core ·
Live Footage Exposes Lazarus Group’s Covert IT-Worker Pipeline Targeting U.S. Finance and Crypto Firms in a State-Backed Espionage and Funding Scheme
any.run ·
Changpeng Zhao has warned that North Korean hackers use fake job postings, insider hires, and phishing tactics to infiltrate top crypto firms and steal user funds. He pointed to recent hacks tied to Lazarus Group and others, including a $400M breach allegedly linked to Coinbase’s outsourced customer support.
crypto.news ·
North Korea’s Lazarus Group has been linked to a $23M hack on UK crypto startup Lykke, involving 158 BTC and 2,161 ETH. The stolen crypto was laundered via DAI swaps and dispersed across multiple wallets, according to ongoing investigations.
Cryptonews ·