North Korea-Linked Lazarus Group Launches Operation 99: A New Cyber Attack Campaign Targeting Software Developers
January 15, 2025
The North Korea-linked Lazarus Group has been attributed to a new cyber attack campaign dubbed Operation 99 that targeted software developers looking for freelance Web3 and cryptocurrency work to deliver malware.
The Campaign Begins with Fake Recruiters
"The campaign begins with fake recruiters, posing on platforms like LinkedIn, luring developers with project tests and code reviews," Ryan Sherstobitoff, senior vice president of Threat Research and Intelligence at SecurityScorecard, said in a new report published today.
Malicious GitLab Repositories
"Once a victim takes the bait, they’re directed to clone a malicious GitLab repository – seemingly harmless, but packed with disaster. The cloned code connects to command-and-control (C2) servers, embedding malware into the victim’s environment."
Global Impact
Victims of the campaign have been identified across the globe, with a significant concentration recorded in Italy. A lesser number of impacted victims are located in Argentina, Brazil, Egypt, France, Germany, India, Indonesia, Mexico, Pakistan, the Philippines, the U.K., and the U.S.
Unique Recruitment Scheme
What makes Operation 99 unique is that it entices developers with coding projects as part of an elaborate recruitment scheme that involves crafting deceptive LinkedIn profiles, which are then used to direct them to rogue GitLab repositories.
Malware Payloads
The end goal of the attacks is to deploy data-stealing implants that are capable of extracting source code, secrets, cryptocurrency wallet keys, and other sensitive data from development environments. These include Main5346 and its variant Main99, which serves as a downloader for three additional payloads:
- Payload99/73 (and its functionally similar Payload5346), which collects system data (e.g., files and clipboard content), terminates web browser processes, executes arbitrary, and establishes a persistent connection to the C2 server
- Brow99/73, which steals data from web browsers to facilitate credential theft
- MCLIP, which monitors and exfiltrates keyboard and clipboard activity in real-time
Financial Theft
"By compromising developer accounts, attackers not only exfiltrate intellectual property but also gain access to cryptocurrency wallets, enabling direct financial theft," the company said. "The targeted theft of private and secret keys could lead to millions in stolen digital assets, furthering the Lazarus Group’s financial goals."
Modular Design and Flexibility
The malware architecture adopts a modular design and is flexible, and capable of working across Windows, macOS, and Linux operating systems. It also serves to highlight the ever-evolving and adaptable nature of nation-state cyber threats.
North Korea’s Financial Goals
"For North Korea, hacking is a revenue generating lifeline," Sherstobitoff said. "The Lazarus Group has consistently funneled stolen cryptocurrency to fuel the regime’s ambitions, amassing staggering sums. With Web3 and cryptocurrency industries booming, Operation 99 zeroes in on these high-growth sectors."
Stay Informed
Found this article interesting? Follow us on Twitter and LinkedIn to read more exclusive content we post.
Source Link
