Search

TechCrunch, in speaking with Google, brought the North Korea angle to light. The attack was attributed to UNC1069, a "financially motivated threat actor" who's been pulling these types of ploys "since at least 2018." Here's where the story really takes off. According to Saayman, the timeline of the attack began roughly two weeks before March 31, when a "social engineering campaign [was] initiated against the lead maintainer." Saayman goes into more details in the comments section of the post-mortem post. He explains that the bad actors "reached out masquerading as the founder of a company" aft