North Korean Hackers Deploy New Malicious Python Packages in PyPI Repository
31-Aug-23
An continuing supply chain effort for malicious software known as VMConnect has resulted in the discovery of three more rogue Python packages in the Package Index (PyPI) repository. Indications point to North Korean state-sponsored threat actors being involved in this campaign. ReversingLabs, which found the packages tableeditor, request-plus, and requestspro, is where the information is from.
VMConnect is a term used to describe a group of Python packages that imitate well-known open-source Python tools in order to download an unidentified second-stage malware. The firm and Sonatype first made this information public at the beginning of the month.
