Oliver Smith

malware research @ aikido security

[Charlie Eriksen @CharlieEriksen]

For those playing along at home, it's very much confirmed that the two PHP configuration changes don't mitigate the issues:

https://t.co/J3Ok3MzPxc

Having seen the patches, I can't stress the importance of patching enough. There be dragons.

[Oliver Smith @oliver_ojsec]

PolinRider updating malware in an infected git repo with a "remove malware" message seems like a rare example of levity from a DPRK actor. You see it all the time from ecrime and some other actors but DPRK are usually all business in my experience.

[Oliver Smith @oliver_ojsec]

@timboloman The same compromised account that commits the action file runs it once, shortly after dropping it. Same account that commits the PolinRider files

[Oliver Smith @oliver_ojsec]

There's a strange overlap between PolinRider and a malicious Action spreading across GitHub. The Action collects runner secrets, vars and cloud credential files into a tarball, base64-encodes it and POSTs it to hxxps[:]//webhook[.]site/b61ec04f-205c-44b2-bb07-f9ae2d9741a0. The Action on runs when triggered manually.

The Action has been active since 27 September and has been planted in at least 450 repos across 56 namespaces. The webhook has received enough data to exceed its free limit. Around 1 in 10 infected repos also carry PolinRider, and in every case I checked, PolinRider was there first, for days to months before the Action arrived. It's hard to say at present whether this is victimisation by two independent threat actors or a new addition to the PolinRider toolkit.

PolinRider gets less attention than worms but is by far the most persistent GitHub-spreading threat, and stolen CI/CD credentials make a foothold in production infra or software supply chains more likely. One to watch.

[Oliver Smith @oliver_ojsec]

Full writeup: https://t.co/foiDJi63CC

[Oliver Smith @oliver_ojsec]

tensorlake 0.5.144 is compromised on NPM

[Oliver Smith @oliver_ojsec]

The threat actor's ethereum wallet, used to trigger the blockchain dead drop C2 resolver: 0xb614155Fd88114d40549b259457Bcf921Df091B9

The transaction listing the C2 happened back on 21 September, so this has likely been cooking for a while

[Oliver Smith @oliver_ojsec]

Drops hackbrowserdata binary to hosts (e.g. for linux, 16b8a1e335b7ad9856c65e3745950a5f76a197560749af1f0bb097de4ac57ad1) to obtain more browser credentials. Expanded collection from browser extensions as well, more oriented towards endpoint than CICD targeting

[Oliver Smith @oliver_ojsec]

Compromised GitHub maintainer, malicious code is present upstream and was added by a commit made yesterday

[Oliver Smith @oliver_ojsec]

C2 iseekaigogo[.]com

[Oliver Smith @oliver_ojsec]

Math_Symbol.js b50a00900399ba99fb6ce1fc151519cb99d44320ef2a631f2237e1aea0ad6fec

Same structure as the keyv Shai-Hulud payloads, but a unique "globalThis.WORMTAG='tensrlake';" marker, so not reinfection.

[Oliver Smith @oliver_ojsec]

The supplychain.local/MemOS worm from a couple of weeks ago has finally appeared in an infected GitHub repo: https://t.co/u6MMzbwhmy

This is the first apparent replication I've seen to date

[Oliver Smith @oliver_ojsec]

C2 is a hidden service: s5n2uyo6gb6dhirsm5pihwohi6e7ayrwojx4xjow4cqabmbowpezenid[.]onion

[Oliver Smith @oliver_ojsec]

Another new worm attempt - new NPM packages react-nodejs and express-javascript contain a postinstall script that sources simple payloads from codeberg that attempt to self-proliferate through NPM and AUR packages. Simple and unlikely to spread based on current foothold but another indication that some threat actors are still chasing Shai-Hulud's tail

https://t.co/ntu57xVRT6

[Oliver Smith @oliver_ojsec]

Appears to drop the open source CHAOS golang RMM tool to Linux hosts and make it persistent using a systemd service. Also installs TOR and sets an environment variable to route C2 traffic over TOR

[Oliver Smith @oliver_ojsec]

There may be a new wave of Shai-Hulud payloads kicking off.

vbenjs/vben-admin-thin-next and ant-design/pro-components were both compromised on GitHub two hours ago with obfuscated .claude and VSCode task files. The payload is the same as the May wave, so this may just be ongoing reinfection.