TLDR Tech / InfoSec
Inside Lazarus: How North Korea uses AI to industrialize attacks on developers
Expel tracked HexagonalRodent (Expel-TA-0001), a DPRK subgroup assessed with medium-high confidence as a subset of Famous Chollima, that social-engineers Web3 developers via fake recruiter outreach and front-company job listings, then ships backdoored coding assessments that detonate BeaverTail and OtterCookie (NodeJS) plus InvisibleFerret (Python) through VSCode tasks.json runOn:"folderOpen" abuse or runtime execution, exfiltrating 26,584 wallets worth up to $12M from 2,726 developer systems in Q1 2026. The toolkit blends into legitimate developer activity via obfuscator.io and Node/Python interpreters that EDRs poorly inspect, with persistent WebSocket C2 to servers including 195.201.104[.]53 (tied to the fast-draft VSX extension supply-chain compromise) and heavy GenAI assistance from Cursor and ChatGPT for vibe-coded loaders, keylogger panels, and AI-generated front-company sites built on Anima. Defenders should hunt for Node or Python processes holding persistent TCP sessions to suspicious IPs (netstat -an | grep 195.201.104.53), open take-home assessments only in disposable VMs with VSCode workspace trust enforced and auto-tasks disabled, audit any shipped tasks.json, and require hardware security tokens for high-value crypto wallets to neutralize credential exfiltration.
Read the full story