Is the US targeting Solana devs in Russia with crypto ‘infostealers’?

Russian Solana devs are being targeted by “infostealer” malware, possibly deployed by US state-sponsored actors, according to research by software supply chain security firm, Safety.

The findings, published by Safety’s Head of Research Paul McCarty, led to speculation from security news outlet The Register, that it could point to an attempt from the US to disrupt Kremlin-linked ransomware gangs.

According to McCarthy’s research, a threat actor using a cryptocurrency-focused “infostealer” dubbed “Solana-scan” has been targeting Solana community members with Russian IPs.

The malicious packages, “solana-pump-test” and “solana-spl-sdk,” were uploaded to the JavaScript registry NPM by someone with the username “cryptohan.” They pretend to scan “for Solana SDK components” while stealing data on crypto credentials and owned tokens.

“Cryptohan” is a popular moniker in the crypto community and was presumably chosen to give the malware an “illusion of legitimacy.”