The Lazarus hacker group has just transferred 400 ETH (about $750,000) through the Tornado Cash money mixing service, while also distributing new malware targeting software developers and cryptocurrency wallets.
On March 13, blockchain security firm CertiK warned on the X platform about a suspicious transaction involving 400 ETH transferred to Tornado Cash. CertiK confirmed that this fund flow is related to Lazarus' previous activities on the Bitcoin network.
This activity takes place in the context of Lazarus being accused of being behind several recent large-scale attacks, including the attack on the Bybit exchange on February 21, which caused $1.4 billion in damage. The group is also suspected of being involved in the Phemex exchange hack in January, which caused $29 million in losses, and previously shocked with the Ronin network attack in 2022, stealing $600 million.
According to statistics from Chainalysis, North Korean hackers have stolen more than $1.3 billion in cryptocurrency assets through 47 attacks in 2024 alone, doubling the total losses of 2023.
New malware campaign targeting the NPM ecosystem
Alongside direct attacks on exchanges, Lazarus has also expanded its scope to the software development field. Cybersecurity experts at Socket have recently discovered a new malware distribution campaign targeting the Node Package Manager (NPM) ecosystem - the widely used JavaScript library and package repository.
Socket reported that the Lazarus group has deployed six new malicious software packages designed to infiltrate development environments, steal login information, extract cryptocurrency data, and install backdoors. These packages use "typosquatting" techniques - impersonating popular libraries by changing a few characters in the name to deceive developers. "BeaverTail" is one of the typical malicious packages in this campaign.
The malware specifically targets cryptocurrency wallets like Solana and Exodus Wallets, attacks files in Google Chrome, Brave, and Firefox browsers, as well as keychain data on macOS. The primary targets of the attack are developers - individuals with a high likelihood of inadvertently installing the malicious packages during their work.
While precisely attributing this campaign to Lazarus still poses challenges, researchers note that "the tactics, techniques, and procedures (TTPs) observed in this NPM attack show clear similarities to Lazarus' previous activities."
