Lazarus Targets Typos in PyPI Malware

The Lazarus hacking group recently attempted to infect developer systems by uploading four malware-infected packages to the Python Package Index (PyPI) repository. The packages, namely pycryptoenv, pycryptoconf, quasarlib, and swapmempool, were collectively downloaded 3,269 times before being removed. Of these, pycryptoconf garnered the most downloads at 1,351. According to JPCERT/CC researcher Shusei Tomonaga, the similarity of names like pycryptoenv and pycryptoconf to legitimate Python encryption package pycrypto suggests the attackers targeted users’ typographical errors during package installations.

This revelation follows closely on the heels of Phylum’s discovery of rogue packages on the npm registry, part of a campaign called Contagious Interview targeting software developers. What’s particularly intriguing about both attacks is the concealment of malicious code within a test script (“test.py”). In this instance, the script serves as a decoy for an XOR-encoded DLL file, which generates two additional DLL files, IconCache.db and NTUSER.DAT. The latter is used to execute IconCache.db, housing the Comebacker malware, responsible for establishing connections with a command-and-control server to retrieve and run a Windows executable file.

JPCERT/CC asserts that these packages represent a continuation of a campaign initially detailed by Phylum in November 2023, where crypto-themed npm modules were exploited to disseminate the Comebacker malware. Tomonaga cautions users to be vigilant during software installations to avoid inadvertently downloading malware, particularly emphasizing the need to double-check package names to prevent typos from leading to the installation of unwanted packages. This incident underscores the importance of robust cybersecurity practices within the developer community to mitigate the risks posed by state-backed hacking groups like Lazarus.