ReversingLabs Details Revived Graphalgo Campaign Targeting Crypto Developers
Summary
ReversingLabs reports that the revived Graphalgo campaign targets crypto developers through fake recruiting and malicious GitHub dependencies, delivering an encrypted downloader and RAT. Researchers cite reused payloads, timestamps and rewritten Git histories as support
Key points
- Fake recruiters and coding tasks impersonating crypto companies and GitHub organizations are used to lure developers into running project setup scripts.
- In analyzed campaign branches, malicious dependencies moved from npm or PyPI packages to GitHub release artifacts referenced in package-lock.json and fetched during setup.
- The artifacts contain an encrypted, multi-stage downloader that retrieves the same RAT ReversingLabs observed in the earlier Graphalgo campaign.
- The researchers report that infected systems send notifications through encrypted Telegram and Slack channels and submit generated wallet addresses to a Sepolia testnet contract.
- Typosquatted repositories and maintainer names, fake company identities, and rewritten Git histories were used to make attacker-controlled projects appear credible.
- Reused payloads and release patterns, along with GMT+9 commit timestamps, support the researchers’ assessment that the activity is linked to likely North Korean state-sponsored actors.
- ReversingLabs recommends testing cloned projects in a sandbox or virtual environment and using dedicated tools to verify software packages.
Article Details
- Attack Vectors
- Fake recruiter profiles and job interviews lure cryptocurrency developers into running coding-task setup scripts.
- Malicious dependencies are referenced in package-lock.json and fetched as release artifacts from crafted or typosquatted GitHub repositories during npm install.
- An encrypted, multi-stage JavaScript downloader retrieves a remote access trojan from attacker-used URLs.
- Typosquatted repository, maintainer, and organization names, along with rewritten Git histories, make attacker-controlled repositories appear legitimate.
- Successful infections are reported through encrypted Telegram and Slack channels and by submitting generated wallet addresses to a Sepolia smart contract.
- Defensive Notes
- Clone and test third-party repositories in a sandboxed or virtual environment.
- Verify software packages with dedicated security tools such as Spectra Assure.
- Inspect dependency lockfiles and resolved package sources, including dependencies fetched from GitHub release artifacts.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | huvaret[.]art | Campaign malware-hosting and download domain used to serve JavaScript stages. |
| DOMAIN | www[.]veltrixcap[.]org | Fake campaign website domain associated with the Veltrix front-end operation. |
| SHA1 | 5c30d58dc44182f959c8035e990153b3553deace | SHA1 of a downloaded JavaScript stage associated with the campaign. |
| SHA1 | f1487451933a05a680e71dde7a2b11560d2d33a7 | SHA1 of a downloaded JavaScript stage associated with the campaign. |
| URL | hxxps[:]//huvaret[.]art/public/index.js?type=npm&ver=1.2 | URL used by the obfuscated downloader to retrieve the final RAT stage. |
| URL | hxxps[:]//huvaret[.]art/public/startup.js?type=npm&ver=1.2 | URL used to download the second-stage JavaScript payload. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe campaign used an encrypted, obfuscated JavaScript downloader to conceal its staged payload retrieval.T1036 · MasqueradingThe operators used typosquatted repositories and maintainer names, including Ijharb/side-channel-weakmap imitating ljharb/side-channel-weakmap.T1059.007 · JavaScriptThe JavaScript dependency ran during project setup and npm install to download and execute the campaign’s staged payload.T1071 · Application Layer ProtocolSuccessful infections were reported through hardcoded, encrypted Telegram and Slack channels.T1105 · Ingress Tool TransferThe multi-stage downloader retrieved the RAT from campaign URLs, including the two huvaret[.]art payload URLs.T1195.002 · Compromise Software Supply ChainMalicious dependencies were embedded in project files and delivered as GitHub release artifacts rather than through the npm or PyPI registries.T1566 · PhishingFake recruiter profiles, job interviews, and job-offering posts were used to lure developers into running malicious project tasks.
People
Products
GitHubThe graphalgo campaign uses fake job interviews, cloned GitHub organizations, typoâsquatted repositories and crafted GitHub release artifacts to deliver an encrypted multi-stage downloader and a RAT to targeted cryptonpmAttackers migrated from publishing malicious packages to OSS registries (npm/PyPI) to hosting malicious dependencies as GitHub release artifacts referenced in package-lock.json, reducing detection risk.PyPIAttackers migrated from publishing malicious packages to OSS registries (npm/PyPI) to hosting malicious dependencies as GitHub release artifacts referenced in package-lock.json, reducing detection risk.Sepoliaare reported via encrypted Telegram/Slack channels and by writing generated wallet addresses to a Sepolia testnet smart contract.Slackmulti-stage downloader that fetches a RAT; successful infections are reported via encrypted Telegram/Slack channels and by writing generated wallet addresses to a Sepolia testnet smart contract.Telegramencrypted, multi-stage downloader that fetches a RAT; successful infections are reported via encrypted Telegram/Slack channels and by writing generated wallet addresses to a Sepolia testnet smart contract.