Skip to content

Back to the catalog

The OpenSourceMalware Show #10
opensourcemalware.comtalk

The OpenSourceMalware Show #10

Podcast/video episode of The OpenSourceMalware Show where researcher Paul McCarty details three active DPRK Lazarus Group supply-chain malware techniques: "version sandwiching" (publishing benign package versions before and after a malicious one, then pinning delivery to the malicious version so latest-version scanners miss it), reuse of Aptos/Tron/Binance BSC blockchain addresses with mutable memo fields as C2 infrastructure to tie campaigns together, and human-readable campaign name strings (e.g. a6-shadow-15, a6-orion-271) embedded in payloads for internal tracking. It also covers broader trends: low-sophistication threat actors using vibe-coding to port payloads across npm/PyPI simultaneously, "package clusters" where only 1-2 of several published packages carry the actual payload, and dynamic imports/payload splitting that pull code from arbitrary CDN URLs at runtime to bypass package managers, firewalls, and Artifactory.

TL;DR OpenSourceMalware researchers break down Lazarus Group's version-sandwiching, blockchain-memo C2 reuse, and campaign-name tagging, plus rising cross-ecosystem clusters and dynamic-import payload delivery.
Open original ↗

Organisations named here

  • easy-day-js

Technologies named here

  • OpenSourceMalware
  • npm
  • PyPI
  • Socket
  • VS Code Marketplace
  • Open VSX
  • Cursor and Windsurf
  • tailwind-color-shades
  • secure-box
  • EasyDay JS dependency
  • VS Code
  • Aptos
  • TRON
  • mastra

Techniques named here

  • Version sandwiching
  • Blockchain address/memo reuse as mutable C2 infrastructure
  • Campaign name string tagging
  • Cross-ecosystem package publishing
  • Package clustering
  • Dynamic imports at runtime
  • Payload splitting
  • VS Code tasks.json payload abuse

Threat actors named here

  • Lazarus Group
  • TeamPCP
  • GlassWorm
  • Contagious Interview
  • Unnamed Chinese threat actor clusters
  • Unnamed Indonesian threat actor clusters
  • Unnamed Russian threat actor clusters
  • DPRK

Related in Threat Intel