Researchers in cybersecurity have identified a group of 13 npm packages that are being used to distribute a new type of JavaScript malware, referred to as WeaselBiscuit. This newly discovered malware has been linked to North Korea’s previous cyber campaigns, specifically mirroring functionalities seen in BeaverTail and OtterCookie, two known malware strains.
Characteristics of WeaselBiscuit Malware
According to OpenSourceMalware, WeaselBiscuit’s design is notably streamlined, removing many of the complex features found in its predecessors. Security expert Paul McCarty highlights that the malware is lighter and more self-contained compared to BeaverTail and OtterCookie. Jenn Gile of OpenSourceMalware elaborates that the name reflects its smaller scale, akin to how a weasel is smaller than an otter.
The npm packages involved include names such as @biz44/id10-client and @biz44/process-runtime-utils. These packages facilitate the malware’s operation by importing a loader script that downloads the main malicious code from a remote server.
Functionality and Impact
WeaselBiscuit operates without the advanced features seen in other malware. It lacks remote access, persistence mechanisms, and cryptocurrency wallet theft capabilities. Instead, it focuses on accessing Chrome extension storage, potentially compromising sensitive data within those extensions.
The malware retrieves its command-and-control configuration from a separate URL and gathers information from the infected host. It is capable of logging clipboard activities and keystrokes, specifically on Windows systems. This functionality poses a significant risk by exposing sensitive data stored in browser extensions.
Potential Attribution to North Korea
While OpenSourceMalware acknowledges similarities with North Korean operations, there is no conclusive evidence linking WeaselBiscuit directly to North Korean threat actors. However, the use of Npoint.io and similar command structures suggest a potential connection.
These findings align with previous observations by NVISO and Cisco Talos, which noted the blending of features from BeaverTail and OtterCookie in other npm packages. The continued evolution of these threats underscores the importance of vigilance in the cybersecurity community.
As the investigation into WeaselBiscuit continues, researchers stress the necessity of protecting systems from such malware, particularly those that could exploit vulnerabilities in widely used platforms like npm.
