Inside a North Korean Phishing Operation Targeting DevOps Employees

SecurityScorecard's STRIKE Team detected and blocked a Lazarus-attributed campaign that used fake job offers on LinkedIn and malicious Bitbucket repositories to trick developers into running a NodeJS/JavaScript backdoor which fetched a base64/XOR-encoded second-stage credential-stealer; investigators identified C2 infrastructure (notably 147.124.214.129), a MongoDB storing victim interaction data, and victims in Pakistan, Brazil, and the United States.