A new attribution for a familiar threat

North Korean hackers are behind a string of high-profile compromises of open-source software libraries, according to a new report from Amazon researchers. The company says the threat actor known as SapphireSleet hit four separate JavaScript packages hosted on the Node Package Manager (NPM) repository.

The findings, released Wednesday, link the group to incidents that had previously only been partially attributed. Security researchers had already tied the axios compromise to North Korea, but Amazon says the earlier attacks on other packages were not publicly connected to the same operation.

Four packages, one campaign

Amazon’s timeline shows a methodical campaign stretching over a year. The attackers first compromised the typo-crypto package in March 2025. By September of that year, they had moved on to the popular debug and chalk packages. Then, in March 2026, the same operation appeared to compromise axios.

That last one is significant. Axios is one of the most widely used JavaScript libraries in the world, downloaded more than 100 million times each week. It’s embedded in countless web applications and enterprise services. A malicious update to a package like that can ripple outward fast.

How the attacks worked

In each case, Amazon says the hackers gained access by socially engineering a trusted maintainer of the software package. Once inside, they published a malicious update. Organizations that automatically installed the latest versions unknowingly downloaded malware.

This is a key detail. SapphireSleet doesn’t rely on software vulnerabilities. It relies on people. The group’s attacks are designed to steal passwords, cryptocurrency assets, and personal data.

Who is SapphireSleet?

Earlier in March, Google attributed the axios attack to a North Korean threat actor it tracks as UNC1069. Microsoft linked the same compromise to Sapphire Sleet, which it says overlaps with activity that other vendors track as UNC1069, BlueNoroff, Stardust Chollima, CageyChameleon, and Alluring Pisces.

Amazon’s report essentially confirms that all four package compromises were the work of the same group. That’s a broader footprint than previously understood.

Why open-source repositories are targets

Open-source software repositories have become increasingly attractive targets for financially motivated hackers, Amazon said. The logic is simple: rather than breaking into organizations individually, attackers can compromise a handful of widely used software packages and potentially gain access to thousands of downstream environments at once.

“When an attacker compromises a widely used open source package, every organization that depends on that package is potentially affected,” Amazon researchers said.

The scale of the problem is hard to overstate. A single malicious update to a popular package can reach millions of developers and countless production systems before anyone notices.

North Korea’s cyber theft economy

The motivation here isn’t espionage. It’s revenue. North Korea has increasingly relied on crypto and cyber theft to generate money in the face of international sanctions. The country stole more than $2 billion worth of cryptocurrency in 2025, its largest annual haul on record, according to previous reports.

That kind of money funds weapons programs and keeps the regime afloat. It also makes North Korean hackers among the most persistent and well-resourced threat actors in the world.

What this means for developers

Amazon reported the malware used in the campaign to the Open Source Vulnerabilities database, where it is tracked as MAL-2026-3400. That’s useful for defenders, but the broader lesson is about trust.

Open-source packages are maintained by volunteers, often with limited resources. A determined adversary can target those maintainers with phishing, credential theft, or other social engineering tactics. The result is that even the most reputable packages can be compromised.

For organizations, the takeaway is to audit your dependencies. Know what you’re installing and where it comes from. Consider pinning versions rather than automatically pulling the latest release. And treat open-source code with the same scrutiny you’d apply to any third-party software.

This is a reminder that supply chain security isn’t just about vendors and hardware. It’s about the code you build on. The next time you run npm install, think about who wrote that package — and who might have gotten to them first.

Attackers Built a Trusted Execution Lane Before the Malware Even Landed

A previously undocumented loader framework is making the rounds, and it has a clever trick: it disguises Go code inside a counterfeit Python runtime. The kicker? It first tells Microsoft Defender to look the other way.

Researchers at Blackpoint Cyber’s Adversary Pursuit Group (APG) published their findings on July 30. The intrusion hit two endpoints at a law firm and deployed two never-before-seen families: a Go loader they call HollowFrame and a pair of Rust backdoors dubbed Matryoshka.

From Phishing Email to Defender Exclusions

The attack chain started with a spear phishing email sent to several staff members. A link in the message routed recipients through an attacker-controlled redirector to an encrypted archive hosted on Mega. Inside sat a shortcut file named Case Documents.lnk.

Executing that shortcut wrote Base64 content to a temporary file, rebuilt a script using the built-in certutil utility, and then launched an obfuscated PowerShell chain that prompted the user for administrator rights.

Once elevated, that stage created Defender exclusions covering both a staging directory and the process name python.exe. Only then did it begin downloading executable content. Blackpoint said the actor had “effectively prepared a trusted looking execution lane” before the loader arrived.

The archive it retrieved was named to resemble an official Python embedded distribution, though the filename read amd96 rather than amd64. A small typo, but a telling one.

Python in Name Only

Launching the bundled python.exe with no script or module argument moved the chain into DLL sideloading territory.

The accompanying python311.dll was not CPython. It was a 64-bit Go library exporting just four Python-compatible function names — enough to satisfy the host’s import requirement and hand execution to malicious Go code.

That code was HollowFrame, a modular loader with several execution methods at its disposal:

• Process ghosting
• Module stomping
• Manual PE mapping

This flexibility means the same framework can generate different telemetry on different endpoints, making detection and correlation harder for defenders.

HollowFrame also checked system uptime, installed memory, and cursor movement before running. It offered three persistence routes: a scheduled task, a WMI event subscription tied to new logon sessions, and the Startup folder.

A Dead Drop on GitHub

HollowFrame dropped a native loader that sideloaded a malicious version.dll beside a legitimate OneDrive updater. That placed the first Matryoshka backdoor’s command execution and network traffic inside a trusted Microsoft process.

A second variant, a Rust wtsapi32.dll proxying 41 Windows Terminal Services exports, used GitHub instead. Each victim was assigned a directory in a private repository holding beacon, command, and result files. The operator got tasking and file transfer without running a custom C2 server.

Beyond shell access, this variant could:

• Identify domain controllers
• Enumerate domain computers and privileged group membership
• Inventory network configuration, local privileges, and installed software

Its requests carried a OneDrive user agent, which Blackpoint listed as a detection indicator. For more on this technique, see GitHub used as a covert channel in multi-stage malware campaigns.

Detection and Mitigation Advice

Blackpoint’s recommendations include correlating unexpected GitHub API connections from non-browser processes with requests for tasking files, and flagging signed binaries that load adjacent DLLs from user-writable paths.

The firm also advised:

• Constraining GitHub API access from endpoints with no development role
• Reviewing scheduled tasks and WMI subscriptions for update-themed names
• Detonating password-protected archives and shortcut files in a controlled environment

This attack shows how attackers are getting more creative with execution chains. The fake Python DLL is a neat piece of social engineering aimed at the operating system itself. And the GitHub dead drop? That’s a free, legitimate-looking C2 channel that’s hard to block without breaking developer workflows.

For defenders, the key is to watch for the anomalies: unexpected Defender exclusions, Python processes doing non-Python things, and GitHub API calls from processes that have no business being there.

State hackers and cybercriminals may be working from the same playbook

For years, the line between state-sponsored espionage and common cybercrime has been blurring. Now, South Korean authorities say they have evidence that North Korea’s infamous Lazarus Group may be handing its tools directly to ransomware gangs.

A joint advisory from four South Korean security and intelligence agencies, released Thursday alongside a technical report from cybersecurity firm AhnLab, warns of a troubling overlap between Lazarus and a ransomware operation called Gunra. Both have been running parallel campaigns against South Korean targets since 2025. The only real difference? Their endgame.

Lazarus plants espionage backdoors. Gunra locks up files and demands payment.

Same flaws, same fingerprints, same servers

The report, which AhnLab dubbed “Operation Double Barrel,” details striking similarities between the two operations. Both groups exploited the same vulnerabilities in Korean financial security software — programs that are effectively mandatory for anyone using banking or government services in the country.

According to AhnLab, the two campaigns used:

• Identical malware filenames and execution arguments
• The same privilege escalation tools
• Shared command-and-control servers
• The same SSH key fingerprint — a cryptographic identifier akin to a unique digital signature

Both even deleted their malware the same way, renaming files to random four-character strings before wiping them clean.

That’s a lot of coincidences. AhnLab stopped short of definitively blaming both on the same actor, but classified the cases as having “a high likelihood of technical linkage.” The overlaps could indicate collaboration, shared infrastructure, or access brokering, the firm said.

Watering holes and weaponized websites

The scale of the operation is sobering. In 2026 alone, Lazarus hackers installed espionage backdoors in at least 72 organizations — including government agencies, cryptocurrency exchanges, and IT service providers. Gunra, meanwhile, used similar access to encrypt data and extort victims.

Part of the campaign involved compromising 15 legitimate Korean websites across multiple industries. The attackers turned these into watering holes, redirecting select visitors to infrastructure that triggered the software flaws and injected malicious code into legitimate Microsoft processes.

The advisory warns that users may be infected simply by visiting a legitimate website that has been compromised — especially if they’re running outdated security software.

The attackers also ran spearphishing campaigns. One targeted a Korean defense company with emails disguised as a survey about GaN semiconductors. AhnLab noted that some of the lure pages appeared to be generated with AI.

The hosting provider connection

Notably, multiple websites used for the watering-hole attacks were managed by the same Korean website development company. AhnLab assessed that the attackers likely compromised the hosting provider first, then expanded access to client sites through the development company’s management system — rather than hacking each site individually.

That’s a supply-chain approach, and it worked.

A growing entanglement with ransomware

The findings add to a growing body of evidence that Pyongyang-backed hackers are deepening their ties to the ransomware ecosystem. In the past 18 months, different North Korean state-sponsored actors have been linked to the Play, Qilin, and Medusa ransomware operations by researchers at Palo Alto Networks, Microsoft, and Symantec respectively.

That trend came into focus back in 2024, when the U.S. Department of Justice unsealed an indictment against Rim Jong Hyok, an alleged member of the government’s Andariel Unit, for his role in ransomware attacks on U.S. hospitals and healthcare companies.

But the Gunra connection may represent something different. In those earlier cases, North Korean operators joined established criminal franchises as affiliates. Here, the evidence suggests the relationship may run the other direction — with state hackers supplying tools, exploits, and access to a smaller, newer group.

Gunra emerged in April 2025, initially targeting five South Korean companies. The group built its ransomware on leaked Conti v2 source code before transitioning to a ransomware-as-a-service model in January of this year. Prior to the AhnLab report, industry researchers had tentatively linked Gunra to Eastern European operators based on its Conti heritage.

As of March 2026, Gunra had claimed at least 32 victims globally across healthcare, manufacturing, IT, and other sectors. Like many RaaS schemes, it operates a double-extortion model — stealing data before encrypting systems and threatening to publish it on a Tor-based leak site.

Who’s at risk?

AhnLab warned that the danger extends beyond the organizations specifically targeted.

“The Korean financial security software currently being abused… is used not only in various enterprise environments but also on many personal PCs,” the company said. “Because the vulnerabilities can be triggered simply when a user accesses a specific page, not only explicitly targeted organizations but also general user environments running vulnerable software may be exposed to risk.”

The advisory urges both individuals and organizations to update their security software and exercise caution when browsing. The threat isn’t abstract — it’s sitting on legitimate websites, waiting.

For more on how state-backed hackers operate, see our breakdown of North Korean cyber espionage tactics and ransomware-as-a-service trends.