North Korean Hackers Target Node.js Maintainers With Fake Meeting Lures
Summary
Socket reports that a North Korean-linked campaign targeted prominent Node.js maintainers with weeks-long social engineering, fake meeting infrastructure and bogus Microsoft Teams updates to deliver a RAT. Targets reported attacks similar to the Axios maintainer case.
Key points
- Socket reports that multiple high-profile Node.js maintainers, including package creators and security contributors, were targeted.
- The targets reportedly described social-engineering attempts similar to the attack on Axios lead maintainer Jason Saayman.
- In the Axios incident, attackers allegedly used a fake Microsoft Teams update to infect Saayman's computer with a backdoor.
- The campaign reportedly built trust over several weeks using convincing meeting infrastructure, planned calls and rescheduling.
- UNC1069, a North Korean group blamed for the Axios supply-chain attack, is identified in the article as using similar tactics.
Article Details
- Event Type
- Social engineering campaign attributed to UNC1069 targeting high-profile Node.js maintainers, following the Axios supply-chain attack.
- Impact
- In the earlier Axios attack, Jason Saayman’s computer was infected with a backdoor and two malicious package versions were published to the NPM registry. They were removed roughly three hours later and were likely installed by over 3 million users. The current campaign targeted multiple maintainers, who reported similar social engineering attempts; the article does not report that those targets were infected or that their packages were compromised.
MITRE ATT&CK
People
Feross AboukhadijehSocket CEO identified as a target of the social engineering campaign.Jason SaaymanAxios lead maintainer whose computer was reportedly infected with a backdoor before two malicious Axios package versions were published; he explained the incident in a postmortem.Matteo CollinaPlatformatic co-founder and CTO identified as a target of the social engineering campaign.Scott MotteDotenv creator identified as a target of the social engineering campaign.TaySecurity researcher who commented on the Axios postmortem, urging open-source maintainers to take the campaign seriously and report suspicious personas and channels.Ulises GascónNode.js Security Working Group contributor identified as a target of the social engineering campaign.Wes ToddNode Package Maintenance Working Group member identified as a target of the social engineering campaign.
Threat Actors
Products
AxiosThe North Korean threat actor blamed for the Axios supply chain attack has been aiming its social engineering campaign at various Node.js maintainers, Socket reports.Microsoft TeamsAfter inviting Saayman to a Slack workspace, the hackers scheduled a meeting on Microsoft Teams.Node.jsThe North Korean threat actor blamed for the Axios supply chain attack has been aiming its social engineering campaign at various Node.js maintainers, Socket reports.npmThe Axios attack occurred on March 31, when two malicious package versions were published to the NPM registry.SlackAfter inviting Saayman to a Slack workspace, the hackers scheduled a meeting on Microsoft Teams.