New DPRK Interview Campaign Leverages Fake Fonts to Deploy Malware
## Cybersecurity: North Korea's Lazarus Group Supply Chain Attack
Cybersecurity: North Korea's Lazarus Group Supply Chain Attack
The Lazarus Group from North Korea has initiated a sophisticated supply chain attack named "Fake Font," targeting software developers. This campaign utilizes fake job interviews and malicious GitHub repositories to deceive engineers into downloading malware-laden code.
Operational for over 100 days, the campaign has expanded with 19 identified repositories. The malware deployment involves the InvisibleFerret Python backdoor, aimed at stealing cryptocurrency wallets, browser credentials, and maintaining long-term access to compromised systems.
The attack begins on LinkedIn, where developers are approached by individuals posing as recruiters from cryptocurrency and fintech companies. These recruiters, masquerading as hiring managers, suggest completing a coding assessment based on the target's GitHub profile.
Links to repositories appear legitimate, featuring standard web project structures such as React frontends and Node.js backends, along with proper documentation and CI/CD configurations. This authentic appearance complicates the differentiation of malicious repositories from genuine ones.
The Lazarus Group from North Korea has initiated a sophisticated supply chain attack named "Fake Font," targeting software developers.
The campaign exploits Microsoft Visual Studio Code's task automation feature. Each malicious repository contains a .vscode/tasks.json file that executes automatically when opened in VS Code.
The infection mechanism disguises JavaScript malware as web font files with .woff2 extensions. Upon opening the repository, VS Code triggers the execution of the fake font file through Node.js, setting off a multi-stage loader that executes the malware discreetly.
The task configuration settings are manipulated to hide output windows, complicating detection. This approach takes advantage of developers' trust in open-source repositories and development tools, with the repository structure fitting expected layouts.
The campaign demonstrates advanced techniques for bypassing security measures, combining social engineering, supply chain vulnerabilities, and tool-specific features. Targeting developers with access to sensitive systems and cryptocurrency assets, the attack poses significant risks.
Organizations are advised to review GitHub repository access and VS Code configurations to identify potential compromises from this campaign.
Based on reporting by Cyber Security News.