SonatypePDF
How-North-Korea-Backed-Lazarus-Group-is-Weaponizing-Open-Source-Whitepaper.pdf
Excerpt
How North Korea-Backed Lazarus Group Is Weaponizing Open Source to Target Developers 1
How North Korea-Backed
Lazarus Group Is Weaponizing
Open Source to Target Developers
Sonatype Security Research
How North Korea-Backed Lazarus Group Is Weaponizing Open Source to Target Developers 2
Since January 2025 alone, Sonatype’s automated malware detection systems uncovered and blocked 234 unique open source malware packages that can be attributed to the North Korea-backed Lazarus Group, offering unique insights into how nation-state actors are using increasingly sophisticated methods to exploit the open source ecosystem. These packages — nearly all designed to mimic legitimate developer tools — target software engineers and CI/CD environments to gain initial access, exfiltrate data,…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Sonatype on sonatype.com.
Mentioned in the excerpt
More from Sonatype1
- Six npm Packages Use Ethereum Transactions to Retrieve Malicious PayloadsSonatype · Published 10 Aug
On the same topics
- Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRatMalwarebytes · Published 5 Jan 2021
- Kazuar (Malware Family)Malpedia · Added 18 Oct
- Animal Farm APT and the Shadow of French IntelligenceInfosec Institute · Published 8 Jul 2015
- Darktrace Malware Analysis: Unpacking SnappyBeeDarktrace · Published 3 Feb
