CampaignPublished 21 Jan 2026Updated 20 Feb 2026

PurpleBravo’s Targeting of the IT Software Supply Chain

Source AlienVault OTX General

Description

PurpleBravo, a North Korean state-sponsored threat group, targets software developers through fake recruitment efforts, particularly in cryptocurrency and software development sectors. Their toolkit includes BeaverTail, PyLangGhost, and GolangGhost, designed for stealing browser credentials and cryptocurrency information. The group has affected 3,136 IP addresses, mainly in South Asia and North America, compromising 20 organizations across various industries. PurpleBravo's tactics include using fictitious personas, malicious GitHub repositories, and sophisticated malware to infiltrate IT services companies, posing a significant supply-chain risk. The group shows overlap with PurpleDelta, another North Korean threat actor, sharing infrastructure and operational patterns. PurpleBravo's focus on the IT sector in South Asia presents an overlooked threat to organizations outsourcing IT services.

Impact

For European organizations, the PurpleBravo campaign poses a significant risk primarily through the IT software supply chain, especially for those outsourcing software development or IT services to regions like South Asia. Compromise of developer credentials or insertion of malicious code into software products can lead to widespread downstream impacts, including data breaches, intellectual property theft, and disruption of critical business operations. Cryptocurrency firms in Europe are also at risk of losing sensitive wallet credentials and funds. The theft of browser credentials can facilitate further lateral movement and espionage within corporate networks. Given the group's state-sponsored nature and ties to North Korea, there is a heightened risk of espionage and sabotage targeting strategic industries. The supply chain attack vector means that even organizations not directly targeted can be affected if their suppliers are compromised. This could impact sectors such as finance, technology, and critical infrastructure. The campaign's use of sophisticated social engineering and malware tools increases the likelihood of successful infiltration, potentially leading to long-term undetected presence within networks. The medium severity rating reflects the targeted but impactful nature of the threat, with potential for significant confidentiality and integrity breaches if not mitigated.

Defensive guidance

European organizations should implement rigorous vetting and continuous monitoring of third-party software developers and IT service providers, especially those located in or sourcing from South Asia. Enforce strict access controls and multi-factor authentication (MFA) for all developer and administrative accounts to reduce the risk of credential theft exploitation. Monitor for suspicious activity related to GitHub repositories and other code repositories, including unexpected code changes or repository forks from unknown contributors. Employ endpoint detection and response (EDR) solutions capable of detecting malware families like BeaverTail, PyLangGhost, and GolangGhost, focusing on browser credential theft and remote access trojans. Conduct regular security awareness training emphasizing social engineering risks, particularly fake recruitment scams and phishing attempts. Implement network segmentation to limit lateral movement if a compromise occurs. Use threat intelligence feeds to stay updated on PurpleBravo indicators and tactics, and integrate these into security information and event management (SIEM) systems for proactive detection. Regularly audit and update supply chain security policies, including software bill of materials (SBOM) to track dependencies and potential risks. Finally, establish incident response plans specifically addressing supply chain compromise scenarios to enable rapid containment and remediation.

Indicators of compromise

Domains 3

lumanagi.online
powervps.net
residentialvps.com

URLs 1

http://154.58.204.15

IP addresses 185

103.111.113.26
103.125.234.107
103.125.234.161
103.125.234.210
103.125.234.62
103.130.145.210
103.157.217.145
103.16.228.16
103.172.26.58
103.50.33.16

Hashes 1

1ddb90ee672c86e09168792871f6d6d00919b57d24da98d91764e292e765cd29

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 21 Jan 2026, 23:20 UTC

MITRE ATT&CK techniques20 from threat tags

Technical details