#null#

SlowMist's Chief Information Security Officer, 23pds, recently published a tweet revealing a cyberattack campaign dubbed "Operation 99" launched by the Lazarus Group, a North Korea-backed hacking group, targeting Web3 and cryptocurrency developers.The operation involves posing as legitimate recruiters to entice developers through platforms like LinkedIn to participate in seemingly legitimate project testing and code reviews. These developers are then tricked into cloning GitLab repositories containing malicious code, allowing modular malware to be implanted onto their systems. This malware exhibits cross-platform compatibility and is capable of stealing high-value data such as passwords, API keys, cryptocurrency wallet information, and maintaining communication through highly obfuscated command and control (C2) servers, maximizing stealth.This attack serves as a stark reminder for developers to be vigilant, cautiously approaching project testing and code review requests from unfamiliar sources. Developers should avoid cloning code repositories from unknown origins, promptly update security software, and bolster their security measures to mitigate risks.