The North Korean-affiliated cyber group known as Moonstone Sleet has persistently targeted the JavaScript package registry by uploading malicious npm packages, aiming to compromise Windows systems.
According to Datadog Security Labs, two such packages, “harthat-api” and “harthat-hash,” were introduced on July 7, 2024. However, these packages garnered no downloads and were swiftly removed from the registry.
Datadog’s security division, which monitors this threat actor under the name Stressed Pungsan, has identified connections to a new cluster of malicious North Korean activities associated with Moonstone Sleet. Datadog researchers Sebastian Obregoso and Zack Allen pointed out that despite the similarity in name to the Ethereum development tool Hardhat, there was no evidence to suggest these packages were intended for typosquatting. Instead, the malicious code repurposed scripts from the popular GitHub repository “node-config,” which is widely used in npm as “config.”
The Moonstone Sleet group is also known for spreading deceptive ZIP files via platforms like LinkedIn, using fake company identities or freelancing sites to lure victims into running malicious payloads under the guise of a technical assessment.
Microsoft reported in May 2024 that once these malicious npm packages are executed, they use curl to connect to a command-and-control server, downloading additional harmful software like SplitLoader. In another instance, a malicious npm loader deployed by Moonstone Sleet led to credential theft from the LSASS process on Windows systems.
Further investigations by Checkmarx have revealed that Moonstone Sleet continues to attempt to distribute their malicious packages through the npm registry. The newly identified packages execute a pre-installation script defined in the package.json file. This script checks whether the package is running on a Windows system and, if so, reaches out to an external server to download a DLL file. This DLL is then sideloaded using the rundll32.exe utility, although it currently appears to perform no malicious actions—possibly indicating a test of their delivery system or an accidental deployment before the malicious code was added.
In a related development, South Korea’s National Cyber Security Center (NCSC) has issued warnings about North Korean cyber attacks from groups like Andariel and Kimsuky, which have been deploying malware such as Dora RAT and TrollAgent (also known as Troll Stealer) in attacks targeting the construction and machinery sectors in South Korea. The Dora RAT campaign is particularly notable because the Andariel group exploited vulnerabilities in a domestic VPN software’s update mechanism to spread their malware.
