SecurityScorecard has uncovered a stealthy malware campaign orchestrated by North Korea’s notorious Lazarus Group. The operation, dubbed “Marstech Mayhem,” reveals the deployment of an advanced malware implant specifically designed to target cryptocurrency wallets and infiltrate the software supply chain.
The campaign, which began emerging in late 2024, centres around a newly identified implant called “marstech1.” This sophisticated tool marks a significant evolution in the group’s tactical approach, introducing unique functional enhancements that set it apart from previous campaigns.
According to SecurityScorecard’s analysis, the threat actors have established a command and control server hosted on Stark Industries LLC infrastructure. Unlike their previous operations – which typically communicated over ports 1224 and 1245 – this new server operates on port 3000 and employs different tactics, including a Node.js Express backend without the previously observed React web admin panel.
The researchers identified a GitHub profile linked to the Lazarus operator, operating under the username “SuccessFriend.” This account, active since July 2024, maintained a façade of legitimate development work before beginning to publish malware-related repositories in November 2024.
“The implant Marstech seems to be used in limited targeted attacks on the supply chain; it has not surfaced elsewhere, since its two occurrences in late 2024 and Jan 2025,” notes the report.
The malware employs sophisticated obfuscation techniques, including control flow flattening, self-invoking functions, random variable and function names, and anti-debugging measures. This complex architecture enables the malicious code to be embedded within legitimate websites, software packages, and even NPM packages targeting the cryptocurrency and web3 sectors.
Of particular concern is the malware’s specific targeting of cryptocurrency wallets. The implant actively searches for Exodus and Atomic cryptocurrency wallets across Linux, MacOS, and Windows systems, attempting to scan and extract sensitive data from these applications.
The technical sophistication extends to the malware’s data exfiltration capabilities. The implant packages stolen information with unique identifiers and timestamps before transmitting it to the command and control server through encrypted channels.
SecurityScorecard’s researchers also discovered a Python-based implant designed to manipulate browser configurations, particularly targeting the popular MetaMask cryptocurrency wallet extension. This component searches for specific browser directories across multiple operating systems, focusing on tampering with extension-related settings.
“Operation Marstech Mayhem exposes a critical evolution in the Lazarus Group’s supply chain attacks, demonstrating not only their commitment to operational stealth but also significant adaptability in implant development,” the researchers conclude.
This latest campaign by Lazarus Group underscores the persistent threat posed by North Korean state-sponsored actors and serves as a stark reminder of the increasingly sophisticated nature of supply chain attacks.
(Photo by Sergiu Nista)
See also: MIT researchers develop ‘Oreo’ to protect against hardware attacks
Want to learn more about cybersecurity and the cloud from industry leaders? Check out Cyber Security & Cloud Expo taking place in Amsterdam, California, and London. The comprehensive event is co-located with other leading events including Digital Transformation Week, IoT Tech Expo, Blockchain Expo, and AI & Big Data Expo.
Explore other upcoming enterprise technology events and webinars powered by TechForge here.
