Joshua Pate

Security Operations / Endpoint Security / Threat Research / Threat Intelligence

[Feross @feross]

🚨 CRITICAL: Active supply chain attack on axios -- one of npm's most depended-on packages.

The latest [email protected] now pulls in [email protected], a package that did not exist before today. This is a live compromise.

This is textbook supply chain installer malware. axios has 100M+ weekly downloads. Every npm install pulling the latest version is potentially compromised right now.

Socket AI analysis confirms this is malware. plain-crypto-js is an obfuscated dropper/loader that:

• Deobfuscates embedded payloads and operational strings at runtime
• Dynamically loads fs, os, and execSync to evade static analysis
• Executes decoded shell commands
• Stages and copies payload files into OS temp and Windows ProgramData directories
• Deletes and renames artifacts post-execution to destroy forensic evidence

If you use axios, pin your version immediately and audit your lockfiles. Do not upgrade.

[Daniel Hnyk @hnykda]

LiteLLM HAS BEEN COMPROMISED, DO NOT UPDATE. We just discovered that LiteLLM pypi release 1.82.8. It has been compromised, it contains litellm_init.pth with base64 encoded instructions to send all the credentials it can find to remote server + self-replicate. link below

[Joshua Pate @joshpatesec]

@IRSnews @IRSsmallbiz make an EIN confirmation download button that actually works. This button has been an issue for over a decade. Take 5 minutes to fix this button to prevent countless headaches & significantly reduce your call volume. #irs #fail #DoYourJob #webdev101

[William Lam @lamw]

[New] - Useful vSphere Automation techniques for assisting with CrowdStrike remediation https://t.co/S6JXRfdXim

☝️Ability to send VM Keystrokes using vSphere API is still one of the lesser known yet super powerful capability of our platform! Hope this can help our IT admins 🙏

[Joshua Pate @joshpatesec]

Microsoft has released a recovery tool to assist in the recovery of systems affected by the CrowdStrike Channel File blue screen:
https://t.co/WWW6o00aE8
#hugops #crowdstrike #bluescreen

[Karol Paciorek @karol_paciorek]

⚠️ Prepared malware campaign impersonating @DocuSign.

📂 #opendir: 45.61.132[.126:8080

📄 sign_now.vbs - SHA1: ec5a069337d37a76e8dd08a2a7dc30babd2853fa

🖼️ fine.jpg - python script - SHA1: 509a486e0bc62a144f2cc7695a13530299454bd3

@500mk500

[Joshua Pate @joshpatesec]

If anyone knows the path to the native Recall SQLite DLL I can modify the script to use that DLL when accessing the Recall database.

[Joshua Pate @joshpatesec]

I wrote a PowerShell script called Recall Tool which can be used to extract Recall database and image data: https://t.co/B6llz1ROGT
#windows #recall #privacy #PrivacyMatters

[Karol Paciorek @karol_paciorek]

🚨 Two #opendir setups are ripe for a sneaky email campaign loaded with #asyncRAT and #Xworm #malware.

📡#opendir:
57.128.129[.21:9222
57.128.129[.21:8080

C2:
🔗 nmds.duckdns[.org:8895
🔗 xgmn934.duckdns[.org:8896
🔗 xvern429.duckdns[.org:8890
🔗 asyncss.duckdns[.org:8797

[Joshua Pate @joshpatesec]

📷📷 Carbon Black’s nonstop innovation revolution prioritizes and protects customers and partners. Here’s why: https://t.co/Q1TLtXLnCp

[James @James_inthe_box]

#malware #opendir at:

http://invoicetrycloudflare\.com:9983/

[Karol Paciorek @karol_paciorek]

🚨 #opendir: 185.29.11[.28:9999

⚠️ Large collection of malicious: .lnk, .hta, .bat, .vbs, .js files prepared for a fake invoice email campaign: SCANNED.pdf

For example:
kam.cmd - #ASyncRAT
Botnet: Venom Clients
C2: undjsj.duckdns[.org:8890

@500mk500

[Joshua Pate @joshpatesec]

@Broadcom will be showing off @Symantec and @CarbonBlack security solutions at #RSAC2024! Sign up to meet with us here: https://t.co/83JmgxugqW

[Anthony Weems @amlweems]

I've been reverse engineering the xz backdoor this weekend and have documented the payload format and written a proof-of-concept exploit for the RCE. The payloads are signed with an ED448 key, so I patched my own key into the backdoor for testing. :-)

https://t.co/CvKo3xPRkP

[bugcrowd @Bugcrowd]

📢 If you haven't heard by now, there's a new big security vulnerability: CVE-2024-3094 aka the libxz-utils backdoor.

😳 What's most shocking? The backdoor was introduced by none other than Jia Tan, a long-time maintainer of the XZ library. Per https://t.co/B8VHiZZb7E the following timeline events is an excellently documented summary of what we currently know about the introduction of this vulnerability into XZ 👇

Plus, learn the details in our latest blog by #Bugcrowd's own @codingo_: https://t.co/09wl9tSX9H

[vx-underground @vxunderground]

Earlier today @ddd1ms shared information regarding allegations from ALPHV affiliates of ALPHV administrative scamming partners.

A user went online to state they are responsible for ransoming Change Healthcare. They state after receiving payment ALPHV administrative staff suspended their account. They continue to say the suspension was suspicious and March 3rd, 2024 the wallet which received the Change Healthcare funds was emptied.

They conclude the post by unveiling an ALPHV wallet which has received approx. $92,749,381 (or 1401 BTC)

Wallet: 14Q5xgBHAkWxDVrnHautcm4PPGmy5cfw6b

*information and photos via @ddd1ms

[Deutsche Telekom CERT @DTCERT]

🚨 On February 26th and 27th Telekom Security and Bayern-CERT observed threat actor #TA577 phishing campaigns. This time the actor is not spreading malware, but apparently uses NTLMv2 handshakes to steal user credentials/hashes. 🧵1/7

[Joseph Cox @josephfcox]

New: inside the underground site where "neural networks" churn out fake IDs
- I tested, made two IDs in minutes
- used one to successfully bypass the identity verification check on a cryptocurrency exchange
- massive implications for crime, cybersecurity
https://t.co/hCjHWbKJPf

[vx-underground @vxunderground]

Today Hewlett-Packard disclosed to the SEC that they were compromised by APT29 a/k/a/ Cozy Bear a/k/a/ Midnight Blizzard

Information via @pancak3lullz