Exposing Attack Operations Utilizing PyPI Against Windows, Linux and macOS Platforms
Essential information
- Published
- 08/07/2024 10:50
- Modified
- 08/07/2024 10:56
- Tags
- 2024-07-08 apt comebacker cross-platform lazarus malware pypi supply-chain
- Related entities
- 28 observables, 1 intrusion sets (apt), 10 techniques (mitre), 1 malware
Description
The report details the APT-C-26 (Lazarus) group's recent attack campaign utilizing malicious Python packages hosted on the PyPI repository to deliver payloads targeting multiple platforms including Windows, Linux, and macOS. It analyzes the attack flow, delivery methods, and malware components involved, providing insights into the group's tactics and capabilities spanning various operating systems. The report also attributes the activity to the Lazarus group based on evidence linking it to their previous attack patterns and infrastructure.