Microsoft Blames North Korea for Mastra AI Supply Chain Attack
▼ Summary
– North Korean hacking group Sapphire Sleet conducted a supply chain attack on the open-source TypeScript framework Mastra, compromising over 140 npm packages.
– The attackers took over an npm maintainer account to publish poisoned Mastra code with a malicious dependency called easy-day-js.
– The malware disabled TLS certificate verification, connected to an attacker-controlled server, and delivered payloads targeting Windows, macOS, and Linux systems.
– The campaign aimed to steal cryptocurrency by searching for 166 wallet browser-extension IDs, including MetaMask and Coinbase Wallet, and also gathered system reconnaissance data.
– Microsoft attributed the attack to Sapphire Sleet with high confidence, noting the group’s history of social engineering on LinkedIn against financial and cryptocurrency sectors.
A sophisticated supply chain attack targeting Mastra, an open-source TypeScript framework for building AI-powered applications and agents, has been attributed to North Korean hackers. Cybersecurity researchers at Microsoft Defender Security Research Team and Microsoft Threat Intelligence made the attribution on June 19.
The technology giant assessed with “high confidence” that the activity is linked to Sapphire Sleet, a North Korean state-sponsored group that typically focuses on the financial sector. This conclusion was reached after Microsoft observed that the infrastructure and post-compromise TTPs used in the Mastra campaign matched previously documented Sapphire Sleet operations.
Sapphire Sleet is Microsoft’s designation for the group, which other threat intelligence firms track under names such as APT38, BlueNoroff, Stardust Chollima, and TA444.
According to Microsoft, Sapphire Sleet executed a “large-scale npm supply chain attack,” affecting over 140 packages across Mastra scopes on the npm registry, the world’s largest open-source database for JavaScript code sharing. The attackers aimed to compromise developers by targeting this ecosystem.
The breach originated from a compromised npm maintainer account. The attackers abused its publishing privileges to inject poisoned versions of Mastra code, incorporating a malicious dependency called easy-day-js. This poisoned instance disabled Transport Layer Security (TLS) certificate verification and connected to an attacker-controlled command-and-control (C2) server, which then delivered a malware payload capable of running on Windows, macOS, and Linux systems.
The campaign had a dual purpose. First, consistent with many cyberattacks attributed to North Korea, it targeted cryptocurrency wallets. The malware searched for 166 specific browser-extension IDs associated with wallets like MetaMask, Phantom, Coinbase Wallet, Binance Wallet, and TronLink, aiming to steal funds. Second, it collected browser history and performed reconnaissance on infected machines, gathering data such as hostname, architecture, platform, user ID, installed applications, and running processes.
Microsoft has not disclosed how the privileged accounts were hijacked to poison the packages, but its blog post noted that Sapphire Sleet has a history of using social engineering attacks on LinkedIn against victims in the financial, blockchain, and cryptocurrency sectors. To defend against such campaigns, Microsoft recommends that developers enable multi-factor authentication on all accounts, regularly audit permissions for npm packages, and monitor for suspicious dependencies or unexpected changes in code repositories.
(Source: Infosecurity Magazine)