BeaverTail

chai-as-init 패키지는 인기 패키지인 chai 및 chai-as-promised 패키지명을 모방한 타이포스쿼팅 (Typosquatting)기법을 사용

With the unique fingerprint, we identified 77 malicious GitHub repositories... Running the entire repository ultimately leads to an infection.

유명 테스트 프레임워크인 Chai.js의 플러그인으로 위장한 악성 npm 패키지(chai-as-init)가 v1.4.5 ~ v1.4.7까지 총 3개 버전으로 배포

MITRE ATT&CK # T1195.002 — Supply Chain Compromise: Compromise Software Supply Chain

Tehdit aktörü önceden sömürmüş olduğu JSON Storage servislerini iş görüşmesi adı altında kişiye iletiyor... Hedef kitle : Yazılımcılar, Yazılım Geliştiriciler, İş aramak için görüşmeler yapan DevOps, DevSecops ekipleri.

After 2–3 friendly exchanges, the recruiter sends "please review the codebase before our technical interview." Calendly link, often on a fresh subdomain.

Foreign IT professionals are contacted as part of a common social engineering tactic that involves enticing software developers with fake job interviews. In this scheme, developers apply for positions advertised on platforms like LinkedIn and other recruitment sites.

This will eventually to either Ottercookie / Beavertail malware. Running the entire repository ultimately leads to an infection.

InvisibleFerret is modular Python malware... Finally, the next stage is downloaded from the C&C server ... and executed using the downloaded Python environment.

İlk aşamada malware, BearVerTail adında bir JavaScript dosyasını run ediyor ve Payload yerleşimi başlıyor.

Candidates are asked to perform a coding test or review a project, which requires them to download files from repositories like GitHub. These files contain malicious code.

Running the entire repository ultimately leads to an infection.

Dosyalar içerisinde base64 ile encode edilmiş malware tarzında bir payload var... TsunamiKit, base64 ile encode edilmiş bir url yükü taşıyor

In the JavaScript version, the IP address and port are obfuscated using base64 encoding, split into three parts, and swapped around... Other strings are also encoded with base64

The attackers often use a clever trick to hide their malicious code: they place it in an otherwise benign component of the project... where they append it as a single line behind a long comment. This way, it is moved off-screen and stays hidden

If they are found, any .ldb and .log files from the extensions’ directories are collected and exfiltrated. Apart from these files, the malware also targets a file containing the Solana keys stored in the user’s home directory in .config/solana/id.json

The JavaScript-based malware is designed to scan for and exfiltrate sensitive data, with a particular focus on cryptocurrency wallets, browser extension data, and credentials.

BeaverTail then looks for saved login information in /Library/Keychains/login.keychain (for macOS) or /.local/share/keyrings/ (for Linux).

환경변수와 함께 즉시 탈취하는 정보에는 다음과 같은 고위험 자격증명이 포함됩니다... AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, GITHUB_TOKEN, NPM_TOKEN

The collected data along with the computer hostname and current timestamp is uploaded to the /uploads API endpoint on the C&C server.

Both BeaverTail and InvisibleFerret exfiltrate data from the local system.

The only functionality not executed by the operator is the initial fingerprinting, which is done automatically.

Instructional videos have also been found... detailing how to set up a Beavertail malware command-and-control server... Another cluster of Beavertail command-and-control (C&C) servers has been administered through VPN, proxies and RDP sessions from the same Russian IP ranges as well.

safe Json Storage servisleri olarak görülen “JsonSilo, JsonKeeper, Npoint” gibi alanları kullanarak meşru bir trafik gibi görünerek saldırıyı devam ettirdikleri... Aslında burada HTTP trafiği izlenerek olay çözümlenmekte

Zscaler... described a two-part infection chain in which the initial reconnaissance took place over HTTP traffic and FTP was used for data exfiltration... Shortly after the reconnaissance traffic, we observed likely exfiltration FTP traffic between the same IP addresses.

MITRE ATT&CK # T1102.001 — Web Service: Dead Drop Resolver

The user also added a download link to hxxp://65.108.20[.]73/BattleTank[.]exe , which is no longer live and was later updated to hxxp://65.108.20[.]73[:]3000/BattleTank[.]exe .

Most C&C communication we observed was done over ports 1224 or 1244 ... and 1245 ... for backdoor C&C communication over TCP sockets.

axios.post로 공격자 서버(hxxp://144.172.89[.]180:8086/upload)에 전송

They primarily steal cryptocurrency for financial gain... aiming to steal cryptocurrency wallets and login information from browsers and password managers.