Researchers Uncover npm Package Delivering RAT Via Microsoft Executable
- 0 Followers
- 0 Following
- 0 Posts
Malicious Nuget Packages Found Delivering SeroXen RAT
blog.phylum.io/sophisticated-highly-targeted-atta…
tl;dr several packages were recently published to npm that appear to be subtle command and control. Behaviors of the infrastructure seem to mimic those recently identified by Phylum as being nation state activity from North Korea.
Sophisticated, Highly-Targeted Attacks Continue to Plague npm
⚠️Update Aug 16, 2023: This appears to be an ongoing campaign. The actor recently published another package hreport-preview with slight modifications. Namely pulling reverse shells from https://img.murphysec-nb[.]love ⚠️Update Aug 17-19, 2023: This actor continues to publish packages, most recently crcloud-layout, urs-remote, essc-crypto, mh-web-hardware, and mall-front-babel-directive. The IOCs
Sophisticated, Highly-Targeted Attacks Continue to Plague npm
Targeted npm Malware Attempts to Steal Company Source Code and Secrets
