Lazarus Group Targets Web3 Developers with Fake LinkedIn Profiles in Operation 99
The North Korea-linked Lazarus Group has been attributed to a new cyber attack campaign dubbed Operation 99 that targeted software developers looking for freelance Web3 and cryptocurrency work to deliver malware.
"The campaign begins with fake recruiters, posing on platforms like LinkedIn, luring developers with project tests and code reviews," Ryan Sherstobitoff, senior vice president of Threat Research and Intelligence at SecurityScorecard, said in a new report published today.
"Once a victim takes the bait, they're directed to clone a malicious GitLab repository – seemingly harmless, but packed with disaster. The cloned code connects to command-and-control (C2) servers, embedding malware into the victim's environment."
Victims of the campaign have been identified across the globe, with a significant concentration recorded in Italy. A lesser number of impacted victims are located in Argentina, Brazil, Egypt, France, Germany, India, Indonesia, Mexico, Pakistan, the Philippines, the U.K., and the U.S.
The name of the campaign is derived from the malicious artifacts that have version identifiers labeled as "pay99." SecurityScorecard told The Hacker News that while it doesn't have precise victimology details, the attackers have been able to successfully persuade the targeted developers to execute the repository contents.
The cybersecurity company said the campaign, which it discovered on January 9, 2025, builds on job-themed tactics previously observed in Lazarus attacks, such as Operation Dream Job (aka NukeSped), to particularly focus on targeting developers in Web3 and cryptocurrency fields.
"This tactic continues to be effective because North Korean threat actors are constantly evolving their methods, making their job-themed lures increasingly sophisticated and authentic," Sherstobitoff told the publication.
"By leveraging advancements in technology, such as AI-generated profiles and realistic communication techniques, they are able to craft highly convincing scenarios that deceive even vigilant individuals. The ongoing refinement of these tactics enhances their ability to exploit human trust and curiosity."
What makes Operation 99 unique is that it entices developers with coding projects as part of an elaborate recruitment scheme that involves crafting deceptive LinkedIn profiles, which are then used to direct them to rogue GitLab repositories.
The end goal of the attacks is to deploy data-stealing implants that are capable of extracting source code, secrets, cryptocurrency wallet keys, and other sensitive data from development environments.
These include Main5346 and its variant Main99, which serves as a downloader for three additional payloads –
- Payload99/73 (and its functionally similar Payload5346), which collects system data (e.g., files and clipboard content), terminate web browser processes, executes arbitrary, and establishes a persistent connection to the C2 server
- Brow99/73, which steals data from web browsers to facilitate credential theft
- MCLIP, which monitors and exfiltrates keyboard and clipboard activity in real-time
"By compromising developer accounts, attackers not only exfiltrate intellectual property but also gain access to cryptocurrency wallets, enabling direct financial theft," the company said. "The targeted theft of private and secret keys could lead to millions in stolen digital assets, furthering the Lazarus Group's financial goals."
The malware architecture adopts a modular design and is flexible, and capable of working across Windows, macOS, and Linux operating systems. It also serves to highlight the ever-evolving and adaptable nature of nation-state cyber threats.
"For North Korea, hacking is a revenue generating lifeline," Sherstobitoff said. "The Lazarus Group has consistently funneled stolen cryptocurrency to fuel the regime's ambitions, amassing staggering sums. With Web3 and cryptocurrency industries booming, Operation 99 zeroes in on these high-growth sectors."
(The story was updated after publication to include additional insights from SecurityScorecard.)
Found this article interesting? Follow us on Twitter and LinkedIn to read more exclusive content we post.
Original Article Published at The Hackers News
________________________________________________________________________________________________________________________________
