Operation-Marstech-Mayhem-Report_021025_03.pdf

STRIKE attributes "Operation Marstech Mayhem" to the Lazarus Group: a multi-stage supply-chain campaign using an obfuscated JavaScript implant (Marstech1) and Python components to target developers and cryptocurrency wallets (e.g., MetaMask, Exodus, Atomic). The report documents active C2 infrastructure (notable IPs and ports), GitHub-based distribution from a profile named 'SuccessFriend', advanced obfuscation (control-flow flattening, Base85+XOR), browser-extension tampering to inject malicious payloads, and data exfiltration to /uploads endpoints, emphasizing high operational sophistication and risk to developer supply chains and crypto users.