LofyGang

Executive Summary

LofyGang is a financially motivated, sophisticated threat actor that monetises through malware-as-a-service and supply‑chain attacks targeting the npm ecosystem. They deliver dual‑stage infostealers—Node.js loaders with native C++ payloads—that steal browser credentials, credit cards, and IBANs from users of Minecraft, gaming, finance, media and government sectors across North Korea, Brazil and the Netherlands. The group also exploits Fortinet's CVE‑2022‑40684 for privileged network access and uses Discord, Telegram and public cloud sites as exfiltration and command‑and‑control conduits.

Goals & Targeting

LofyGang's strategic objective is pure financial gain. By targeting popular online sectors—gaming, finance, media, government—they can acquire valuable monetary assets such as digital wallets, credit cards, and IBANs. Their supply‑chain approach allows widespread propagation with low effort, while the exploitation of Fortinet devices broadens their reach into corporate networks for lateral movement. The actor focuses on North Korea, Brazil, and the Netherlands, taking advantage of language support in Brazilian Portuguese (for C2 messages) and a large user base of gamers in the Americas. Victims are typically individual users with high-value credentials or developers who inadvertently ship malicious packages. Once compromised, LofyGang monetises through secondary services such as a “Lofy Boost” Discord bot that sells stolen cards and boosts channel activity for operators. Key capabilities include supply‐chain attacks via npm, native syscall injection, credential theft across multiple browsers, exfiltration over WebSocket/Discord, and fortinet device exploitation.

Key Capabilities

• Starjacking in the npm ecosystem
• Typosquatting of npm package names
• Distributing malicious packages that delete release artifacts and metadata
• Credential theft via browser injection (cookies/passwords/IBANs) from Chrome, Edge, Firefox, Brave and Opera
• Stealth process injection into browser processes using syscall‑level techniques
• Exploiting Fortinet CVE‑2022-40684 to gain privileged access on network devices
• Tracking Linux devices via new TCP source port generation mechanism
• Employing hardcoded strings and Discord webhook injection for persistence
• Social engineering through fake game cheat icons (e.g. Minecraft icon in Slinky)
• Deploying stolen credit cards via a Discord bot requiring operator credentials
• Leveraging native binaries with syscall‑level process injection
• Exfiltrating data through Discord, Telegram, gofile.io, and catbox.moe
• Capturing screenshots to a WebSocket RAT named ScreenLiveClient
• Using multiple cloud services (Discord, Repl.it, glitch, GitHub, Heroku) as command‑and‑control infrastructure
• Implementing persistent hidden malware within infected operators

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

LofyGang conducts high‑frequency campaigns that rely on a large number of npm developer accounts to upload almost 200 malicious packages. Their malware-as-a-service offering provides operators with free and premium tiers, allowing rapid scaling of attacks across the targeted sectors. Victims range from individual gamers and e‑commerce users to developers publishing software. The group routinely exploits Fortinet CVE‑2022‑40684 to expand its foothold within corporate networks. Notably, LofyGang resurfaced in early 2024 with new dual‑payload npm packages and a sophisticated browser credential stealer, demonstrating persistence and adaptability. The actor’s operational tempo includes automated compilation via GitHub Actions, immediate exfiltration through WebSocket or Discord, and cleanup mechanisms that delete package metadata after successful injection. Their use of cloud services for C2 adds resilience against takedown efforts. Financial impact is largely driven by the sale of stolen cards in a black‑market ecosystem, while secondary revenue streams emerge from boosting Discord channels using compromised credentials.

IOC Patterns

• hardcoded strings such as 'ConsoleLofy' or '=== Lofygang Started ==='
• author field containing keyword 'Lofy'
• webhook usernames set to 'Lofygang'
• folder name 'lofygang-local'
• Portuguese log messages like 'Conectado ao servidor'
• Discord injection techniques
• command line patterns such as 'node client.js --bg', '_nyx_launch.vbs', 'svchost.vbs'
• malicious npm package uploads across multiple developer accounts
• typosquatting and starjacking in npm packages
• use of Discord bots for command‑and‑control
• cloud services (Repl.it, glitch, Heroku) used as C2

Recommended Actions

• Uninstall malicious npm packages such as undicy-http and any packages authored by suspicious developer accounts.
• Terminate suspicious processes including Node.js running 'client.js --bg', '_nyx_launch.vbs', and 'svchost.vbs' via task manager or scripts.
• Remove persistence artifacts (e.g., registry keys, scheduled tasks, hidden directories like 'lofygang-local').
• Patch Fortinet devices against CVE‑2022-40684 and disable unused authentication methods on all network appliances.
• Monitor npm repositories for unauthorized deletions of package metadata or sudden appearance of duplicate descriptions (starjacking).
• Educate users to verify authenticity of game cheat tools, check official icons, and update passwords after potential compromise.
• Implement continuous scanning of npm packages during build pipelines (package lock file integrity checks) using tools like Snyk or JFrog Xray.
• Block or heavily filter traffic to known exfiltration domains such as gofile.io and catbox.moe via firewalls and endpoint detection.
• Deploy WebSocket activity monitoring to detect unauthorized ScreenLiveClient connections.
• Implement strict outbound controls for Discord, Telegram, and other public cloud services unless required.

Suggested Tags