The Phantom Circuit: the Lazarus Group's evolution in supply chain compromise

The Phantom Circuit: the Lazarus Group's evolution in supply chain compromise

Speakers: Ryan Sherstobitoff, CIO, SecurityScorecard

Conference: Virus Bulletin

YouTube: https://www.youtube.com/watch?v=J0zcV1evfQo

Overview

In "The Phantom Circuit: the Lazarus Group's evolution in supply chain compromise," Ryan Sherstobitoff, CIO at SecurityScorecard, unveils a sophisticated and persistent campaign by the notorious North Korean state-sponsored threat actor, the Lazarus Group. This talk meticulously details how the group has escalated its tactics, moving beyond simple phishing to orchestrate intricate supply chain attacks targeting software developers worldwide. The primary objective of these operations is financial gain through cryptocurrency theft, a consistent motive for the DPRK. Sherstobitoff’s presentation shines a light on the group's evolving methodologies, from initial social engineering through fake recruitment schemes to deploying highly obfuscated, multi-stage malware and establishing a resilient, layered command and control (C2) infrastructure designed to mask their origin.

The research presented is critical for the cybersecurity community, particularly for organizations engaged in web3 and open-source development. It highlights the increasing threat posed by state-sponsored actors leveraging trusted developer workflows and supply chain vulnerabilities. Sherstobitoff, drawing on his extensive background in tracking DPRK activities—including authoring Operation Troy and leading the private sector response to the Sony Pictures attack—provides an authoritative analysis of Lazarus's strategic shift. The talk not only dissects the technical intricacies of their implants and infrastructure but also demonstrates how SecurityScorecard's strike team successfully traced network activity through multiple layers of obfuscation back to operator IPs in Pyongyang, offering invaluable insights into attribution and defensive strategies.

Background

▶ Watch: Lazarus's fake recruitment scheme & crypto objective (0:50)

The Lazarus Group, a cyber warfare unit tied to the Democratic People's Republic of Korea (DPRK), has long been a prominent figure in the global threat landscape. Their operations are notoriously characterized by a blend of espionage, sabotage, and, increasingly, financial cybercrime, primarily aimed at circumventing international sanctions and funding the regime's illicit activities. Historically, Lazarus has been implicated in high-profile attacks such as the 2014 Sony Pictures Entertainment breach and the 2017 WannaCry ransomware outbreak. More recently, their focus has heavily shifted towards the burgeoning cryptocurrency ecosystem, recognizing its potential for large-scale, relatively untraceable financial theft. This strategic pivot is evident in numerous campaigns targeting exchanges, DeFi protocols, and individual cryptocurrency holders.

The problem addressed by this talk stems from two critical factors: the inherent trust within the software development community and the lucrative, yet often less secure, nature of the cryptocurrency space. Developers frequently rely on open-source packages and collaborative platforms like GitHub, making them attractive targets for supply chain compromise. Previous Lazarus campaigns, such as "Operation 99" and "Mars Mayhem," serve as direct precursors to the "Phantom Circuit." Operation 99 initially uncovered how Lazarus leveraged multi-layered obfuscated Python payloads embedded in legitimate Node.js projects, delivered via weaponized GitHub repositories. This campaign, triggered by an attack against SecurityScorecard's own developers in Latin America, focused on cryptocurrency theft. Mars Mayhem further showcased the group's sophistication, introducing the Marsek1 implant with advanced obfuscation techniques (control flow flattening, Base85 with XOR encoding, anti-debugging) to target cryptocurrency wallets across Windows, macOS, and Linux, specifically aiming for extensions like MetaMask and standalone wallets like Exodus and Atomic. These prior efforts laid the groundwork, demonstrating Lazarus's sustained interest in the software supply chain and their continuous refinement of tools and techniques to exploit developer trust for financial gain, setting the stage for the highly evolved "Phantom Circuit" operation.

Key Findings

▶ Watch: Tracing Lazarus's network back to Pyongyang (10:00)

The "Phantom Circuit" operation represents a significant evolution in the Lazarus Group's supply chain compromise tactics, distinguished by its scale, sophistication, and meticulous operational security. The key findings from SecurityScorecard's investigation reveal a multi-stage, globally targeted campaign with a clear progression from broad reconnaissance to precision targeting.

Firstly, the campaign's timeline highlights a deliberate and escalating approach. It began in September 2024 with infrastructure setup. By November 2024, Lazarus had compromised 181 victims in Europe, indicating a focused reconnaissance phase. This rapidly expanded in December 2024, with over 1,200 victims worldwide, hitting India and Brazil particularly hard, signifying a transition to mass exploitation. By January 2025, the threat actor refined its focus, adding 233 new victims, with a notable 110 specifically in India's technology sector, demonstrating a shift towards strategic, sector-specific targeting. This progression—setup, reconnaissance, mass exploitation, and precision targeting—underscores the group's calculated intent and adaptive capabilities.

Secondly, the talk unveiled a highly resilient and layered obfuscation network designed to conceal the attackers' origin and maintain persistence. Victim traffic was initially funneled through central C2 servers, which were themselves hidden behind various proxy endpoints. The critical breakthrough in attribution was tracing the North Korean operators' connection path: from Pyongyang IP addresses, traffic was first tunneled through AstralVPN exit points, then routed through Oculus proxy infrastructure in Russia, before finally reaching their C2 servers hosted at Stark Industries, a known bulletproof hosting provider. This intricate chain was unraveled using NetFlow and time series analysis, allowing the SecurityScorecard strike team to correlate short bursts of connection activity back to North Korean IPs. This exfiltration method remained consistent across campaigns from November 2024 to January 2025, ensuring reliability for moving stolen data back to Pyongyang.

Thirdly, the investigation provided deep insight into the malware framework and its components. The initial compromise leveraged fraudulent web3 recruitment pitches, luring developers into executing malicious NPM packages or cloning weaponized GitHub repositories. These delivered a Python-based downloader, which then retrieved a suite of modular implants. Key implants discussed include:

• main99: A multi-stage HTTP retriever responsible for downloading additional components (payload, brow, MCIP) from the C2. It demonstrated resilience by self-bootstrapping dependencies like the Python requests library.
• pay99: The primary implant for system profiling, sensitive file discovery (environment files, wallet keys, spreadsheets, documents), exfiltration, and full remote command and control. It also incorporated keylogging and clipboard theft.
• brow99: Focused on persistence and defense evasion, including installing Python if absent, deploying a "tsunami injector" (partial code), and modifying Windows Defender exclusions.
• brow5346: A variant specifically designed for browser credential theft, targeting credit card numbers, expiration dates, and cardholder data, and operating cross-platform (Linux secret storage, macOS Keychain).

Finally, the talk revealed the existence of a custom React backend used by the attackers to manage victims and exfiltrated data. While the database for this backend was found to be offline, the code itself exposed API routes for managing implants and viewing collected data, demonstrating a sophisticated operational infrastructure beyond just the malware itself. These findings collectively paint a picture of a highly organized, technically proficient, and persistent state-sponsored adversary continuously adapting its tactics to achieve its financial objectives.

Technical Deep Dive

▶ Watch: Attackers' custom React victim management backend (12:40)

The Lazarus Group's "Phantom Circuit" operation demonstrates a sophisticated, multi-layered approach to supply chain compromise, combining social engineering, advanced malware, and a resilient C2 infrastructure. The technical execution unfolds in several stages, from initial access to data exfiltration and persistent control.

Initial Access and Delivery:

The campaign begins with social engineering, specifically fraudulent web3 recruitment pitches sent via platforms like LinkedIn to software developers in Latin America and globally. These pitches lure developers into executing malicious NPM packages or cloning weaponized GitHub repositories. These repositories, often appearing as legitimate Node.js projects, contain a hidden embedded link. This link is crucial, as it downloads the initial Python implant, acting as a multi-stage downloader. The use of legitimate open-source workflows as delivery mechanisms is a hallmark of supply chain attacks, exploiting developer trust.

Malware Framework and Components:

The core of the "Phantom Circuit" malware is a modular, Python-based framework designed for stealth, persistence, and extensive data exfiltration.

1. main99 (Multi-stage HTTP Retriever):

• This initial implant, named main99 (derived from campaign 99 and g-type 73), functions as an HTTP retriever.
• It contacts a Command and Control (C2) server on port 1224 and downloads three primary components: payload (the main data collection module), brow (browser and data collection), and MCIP (screenshots and other data).
• Each component is tied to hard-coded identifiers.
• After download, the malware stages these pieces under the user's profile directory before execution.
• Execution primarily uses the Python interpreter. On Windows, it takes an extra step to hide process windows for stealth. On macOS, only the initial payload executes, limiting later stages.
• A key feature of main99 is its self-bootstrapping capability: if Python dependencies like the requests library are not present, it automatically installs them using pip, ensuring smooth execution. This makes the implant highly portable and self-sufficient.

1. pay99 (Primary Implant):

• The pay99 implant is the main payload retrieved by main99.
• It begins by profiling the infected system, collecting host details, usernames, OS versions, and even geolocation data. This information is beaconed back to the C2 on port 1224 to register the host.
• Once established, pay99 performs extensive file discovery and exfiltration, specifically targeting sensitive items such as environment files, cryptocurrency wallet keys, spreadsheets, and business documents, uploading them to the C2.
• Beyond data theft, pay99 enables full remote command and control (C2) over port 2245, granting attackers the ability to execute commands, manipulate processes, and deliver additional payloads.
• It also includes keylogging and clipboard theft functionality, capturing credentials and sensitive copy-paste data in real-time. This provides the attacker with persistent access, comprehensive data theft, and ongoing surveillance.

1. pay9973 (Advanced Variant):

• This is an advanced variant of pay99, offering persistent remote access to the C2 server over port 2245.
• It allows for full control, including command execution, process manipulation, and file upload/download.
• Its theft capabilities are extensive, scanning for sensitive files like environment variables, cryptocurrency wallets, private keys, and business documents for exfiltration.
• To maximize credential harvesting, it hooks into the keyboard, mouse, and clipboard, capturing keystrokes, copy-paste events, and active window details.
• For stealth and persistence, it leverages a hidden directory to track files, execute additional modules, and even self-delete if necessary.

1. brow99 (Persistence and Evasion):

• The brow99 implant focuses on ensuring persistence and long-term control.
• It performs environment preparation, checking for Python installation and silently downloading/installing it if absent.
• For persistence, it deploys what the researchers called the "tsunami injector" (partial code was recovered).
• Crucially, it focuses on defense evasion by modifying Windows Defender exclusions, allowing its malicious components to remain hidden and uninterrupted.

1. brow5346 (Browser and Financial Data Theft):

• A variant with a specialized focus on browser credential theft.
• It harvests credit card numbers, decrypts them, and collects expiration dates and other cardholder data for fraudulent operations.
• This implant is cross-platform, designed to target secret storage in Linux and the macOS Keychain, demonstrating Lazarus's broad targeting capabilities.

1. pay9971 and pay5346 (Additional Variants):

• These are further variants, each with slight functional variations. They primarily offer full remote access and control, arbitrary shell commands, file transfers, browser/process termination, and the ability to deploy additional modules. They also employ evasion techniques and hidden directories for persistence.

1. root5346 (Modular Downloader):

• A recently discovered downloader with modular functionality. It connects to the C2, creates a hidden staging directory, and downloads the primary payload.
• Notably, on macOS, it exits early, but continues execution on Windows and Linux, specifically targeting Linux for keyboard and clipboard monitoring (Mclip) via port 1224.

Obfuscation Techniques:

The Lazarus Group employs significant obfuscation to evade detection. For instance, the Marsek1 implant in the "Mars Mayhem" campaign used control flow flattening, Base85 with XOR encoding, and anti-debugging tricks. The initial payload (main99) was also heavily encoded, requiring extensive unraveling to analyze the original script.

Backend Infrastructure:

The attackers utilize a custom React backend with a NodeJS component, listening on what was identified as port 1224125 (with implants communicating on port 1224). This backend exposes API routes for managing victims and viewing exfiltrated data. The researchers were able to brute-force and extract the original code, revealing functionalities for creating users and managing collected data, although the victim database itself was offline.

Command and Control (C2) Infrastructure and Attribution:

The most striking technical aspect is the multi-layered C2 infrastructure designed for attribution evasion:

1. Pyongyang IPs: North Korean operators initiate connections from their actual locations.
2. AstralVPN: Traffic is first tunneled through AstralVPN exit points, a known TTP for DPRK actors.
3. Oculus Proxy: Subsequently, traffic is routed through Oculus proxy infrastructure, typically located in Russia. These proxies operated across ports 1245 and 3389, blending with normal traffic.
4. Stark Industries C2: Finally, the C2 servers themselves are hosted at bulletproof providers like Stark Industries (a Russian VPS provider).

This intricate path was traced using NetFlow and time series analysis, correlating short bursts of connectivity from Pyongyang IPs through the VPN and proxy layers to the C2 servers. The exfiltrated data is ultimately sent to Dropbox from the C2 infrastructure.

Demo / Proof of Concept

▶ Watch: Brow99 implant: persistence and evasion techniques (18:50)

While the presentation did not feature a live, interactive demonstration of the attack chain from victim compromise to C2 interaction, Ryan Sherstobitoff provided compelling evidence and visual representations of the Lazarus Group's capabilities and infrastructure.

The speaker revealed that SecurityScorecard's team successfully brute-forced and obtained the original code for the custom React backend used by the attackers. He presented a "brief view of what we're able to extract," showing the interface of this backend. This included screenshots of the custom React and NodeJS application, illustrating its capabilities to create different users, manage accounts, and view exfiltrated data. This reverse-engineered access to the adversary's own operational tools served as a powerful proof point of their investigative depth.

Furthermore, the talk included detailed diagrams of the malware's execution control flow, highlighting the complexity of the multi-stage implants. Crucially, Sherstobitoff displayed a screenshot depicting an "interactive session" with the pay9973 implant. This visual evidence demonstrated the attacker's capabilities, including the ability to launch shell commands, upload/download documents, terminate browser processes (e.g., Chrome, Brave), run extra payloads, search for wallets, and monitor keyboard and clipboard activity. Although the database for the C2 backend was "dead," preventing the direct viewing of victim data, the NetFlow telemetry and other sensor data provided sufficient evidence of compromised systems and data exfiltration. These visual artifacts and code insights served as a robust "proof of concept" of the talk's findings, showcasing the functionality and control the Lazarus Group wields through its sophisticated malware.

Defensive Implications

▶ Watch: Browser and financial data theft capabilities (20:00)

The "Phantom Circuit" campaign by the Lazarus Group underscores critical vulnerabilities in the software supply chain and developer ecosystems, demanding a multi-faceted defensive strategy for organizations and individuals alike.

1. Enhanced Developer Security Awareness: Developers are the primary target. Organizations must educate their development teams on the persistent threat of social engineering, particularly through fake recruitment pitches on platforms like LinkedIn. Developers should be trained to scrutinize unsolicited messages, verify sender identities, and be extremely cautious about executing unknown scripts or cloning repositories from unverified sources.
2. Robust Software Supply Chain Security: Implement rigorous practices for managing third-party dependencies. This includes:

• Vetting open-source packages: Use tools to scan NPM packages and other dependencies for known vulnerabilities and malicious code before integration.
• Code signing and integrity checks: Ensure that all code, especially from external sources, is signed and that its integrity can be verified.
• Least Privilege: Limit permissions for build systems and CI/CD pipelines to reduce the impact of a compromise.
• SBOM (Software Bill of Materials): Maintain a comprehensive SBOM to understand all components in your software.

1. Advanced Endpoint Detection and Response (EDR): Deploy EDR solutions capable of detecting anomalous process execution, suspicious Python activity (e.g., pip installing requests library in unexpected contexts), modifications to Windows Defender exclusions, and attempts to access sensitive files or cryptocurrency wallets. EDRs should also monitor for keylogging and clipboard theft attempts.
2. Network Monitoring and Threat Intelligence Integration:

• NetFlow analysis: Organizations should implement robust NetFlow or IPFIX monitoring to detect suspicious traffic patterns, especially connections to known malicious IPs, VPN exit nodes (like AstralVPN), or proxy services (like Oculus). Time series analysis, as demonstrated by SecurityScorecard, can be crucial for identifying veiled connections.
• Outbound traffic restrictions: Restrict outbound traffic to only necessary destinations. Monitor and block connections to known bulletproof hosting providers (e.g., Stark Industries) and suspicious ports (e.g., 1245, 3389, 1224, 2245).
• IOCs: Integrate Indicators of Compromise (IOCs) from threat intelligence feeds, including observed C2 IPs and domain names, into firewalls, proxies, and SIEM systems.

1. Cryptocurrency Security Best Practices: For individuals and organizations handling cryptocurrency:

• Hardware wallets: Strongly recommend the use of hardware wallets for storing significant cryptocurrency holdings, as they offer superior protection against software-based theft.
• Multi-factor authentication (MFA): Enforce MFA on all cryptocurrency exchanges and wallet interfaces.
• Browser extension vigilance: Be wary of malicious browser extensions and regularly audit installed extensions, especially those interacting with web3 environments like MetaMask.
• Isolate crypto activities: Consider using dedicated, isolated environments (e.g., virtual machines) for cryptocurrency transactions.

1. Proactive Threat Hunting: Security teams should proactively hunt for TTPs associated with the Lazarus Group, such as the use of Python-based malware, specific obfuscation techniques (control flow flattening, Base85/XOR), and the targeting of developer tools or cryptocurrency assets. Look for hidden directories, modified system files, or unusual network beacons.

By adopting these comprehensive defensive measures, organizations can significantly reduce their attack surface and improve their resilience against sophisticated state-sponsored threats like the Lazarus Group's "Phantom Circuit" campaign.

Key Takeaways

• Lazarus Group's Evolving Sophistication: The Lazarus Group continues to evolve its tactics, moving from direct attacks to highly sophisticated supply chain compromises that leverage developer trust and open-source workflows.
• Targeting Developers for Crypto Theft: The primary objective is cryptocurrency theft, achieved by targeting software developers through fake recruitment schemes and weaponized NPM packages or GitHub repositories, highlighting the lucrative nature of this vector for state-sponsored actors.
• Layered Obfuscation and Resilient Infrastructure: The operation employs a complex, multi-layered C2 infrastructure, utilizing AstralVPN, Oculus proxy nodes, and bulletproof hosting (Stark Industries) to mask operator origin, which was meticulously traced back to Pyongyang using NetFlow and time series analysis.
• Modular, Cross-Platform Python Malware: The campaign deploys a highly modular, Python-based malware framework (e.g., main99, pay99, brow99, root5346) with extensive capabilities including system profiling, sensitive file exfiltration (wallet keys, documents), keylogging, clipboard theft, and full remote command and control across Windows, macOS, and Linux.
• Critical Need for Developer and Supply Chain Security: Organizations must prioritize developer security awareness against social engineering, implement robust software supply chain security practices, and deploy advanced endpoint and network monitoring to detect and mitigate these stealthy and persistent threats.
• Beyond Technical Controls: Attribution is Possible: The ability to trace the attackers back to Pyongyang IPs demonstrates that despite sophisticated obfuscation, persistent investigative techniques like NetFlow analysis can lead to successful attribution, providing valuable intelligence for defensive strategies.

About the Speaker(s)

Ryan Sherstobitoff is the CIO at SecurityScorecard, bringing over a decade of dedicated experience in hunting and analyzing the cyber activities of the Democratic People's Republic of Korea (DPRK), with a specific focus on the Lazarus Group and its various subgroups. His extensive background includes being the original author of Operation Troy, a significant research effort into North Korean cyber operations. Furthermore, he played a pivotal role in leading the private sector response at McAfee to the infamous Sony Pictures attack, which was also attributed to the Lazarus Group. Sherstobitoff's profound expertise in state-sponsored threats and his history of uncovering complex adversary campaigns make him a leading authority on DPRK cyber activities.