One of the top priorities for any malicious actor conducting an offensive cyber campaign is to avoid being detected by the organizations you compromise. “Persistence,” after all, is the “P” in APT, and both cyber criminals and state- sponsored hacking groups have gotten very good in recent years in avoiding detection as they move laterally within the IT environments they have compromised.
Living (large) off the land
So called “living off the land” techniques are a big part of that success. That refers to the (ab)use of approved, legitimate tools and platforms to carry forward your malicious campaign. Practically, “living off the land” encompasses everything from takeovers of legitimate accounts to the use of technologies like PowerShell, Microsoft’s widely used cross platform scripting language to carry out malicious actions under the guise of legitimate, administrative activities.
More recently, attackers have set their sites on the relatively green fields of software development pipelines to seed malicious code via malicious open source packages, compromised commercial software (see: 3CX) and direct attacks on developers and development infrastructure.
Despite their success in hiding their presence within compromised environments, so-called “command and control” (or C2) – the communications by malicious actors with servers and other Internet based assets they control -have historically been a weak point and a glaring red flag that alert victim organizations that something is amiss. Unexplained communications to and from mystery servers typically spur emergency meetings and a phone call to Mandiant. That’s why malicious actors have – in recent years – gotten clever about C2. As far back as 2022, for example, researchers at ReversingLabs* wrote about the discovery of a malicious npm package masquerading as the Material Tailwind CSS tool. That package, once installed, leveraged public and widely used platforms like Google Drive, Microsoft OneDrive and GitHub to connect with the designated C2 server. That’s because communications to and from sites like Google Drive are unlikely to get much attention.
More recent discoveries show how attackers approach to implementing command and control infrastructure is getting far more complex. In 2023, for example, Karlo Zanki, the same RL researcher observed attackers abusing GitHub Gists, and git commit messages for command and control.
A new page in C2: Ethereum smart contracts
And then there’s the report that dropped this week from Karlo’s colleague Lucija Valentić, a threat researcher at ReversingLabs. In a blog post published on Wednesday, Valentić described her discovery of malicious packages on the Node Package Manager (npm) open source repository that abused Ethereum smart contracts to facilitate malicious command and control.
Valentić wrote that the\ two npm packages—colortoolsv2 and mimelib2—were part of a broader campaign across npm and GitHub and designed to push malicious code to developer systems.
In the campaign, which was first observed in July, the attackers employed Ethereum smart contracts – a kind of open API for use with the Ethereum blockchain – to host URLs of servers that coordinated the downloading the second stage malware to the developers’s systems.
Smart contracts enable automation with blockchain platforms like Ethereum. In this campaign, that was abused by the attackers to their advantage: When the conditions specified to execute a smart contract were met, the contract executed functions defined within the contract without requiring user input. In this case: that is pushing malicious code to the user’s system.
A sophisticated scam targets developers on GitHub
And, while the npm packages weren’t particularly complex or hard to decipher, Valentić and her colleagues found links between the malicious npm packages and a much more subtle and sophisticated campaign on the Github open source platform.
Specifically: Valentić found a range of GitHub repositories and accounts connected to colortoolsv2 that posed as cryptocurrency trading bots. That included projects like solana-trading-bot-v2. (That project has since been removed from GitHub.)
Developers considering using the solana-trading-bot-v2 package would have plenty of reason to feel confident, Valentić points out: that package sported thousands of commits; multiple active contributors; and a good amount of positive reviews and active watchers. Collectively: those are common characteristics of popular and widely used open source repositories.
After digging into that data, however, red flags appeared. The ReversingLabs team noticed that those markers of success were diversions. As for the commits to the solana-trading-bot-v2 package, Valentić found evidence that the actual number of commits had been inflated – likely using automation to make thousands of small but inconsequential “tweaks” to the package (like uploading or modifying license files) on a daily basis.
As for the accounts registered as “watchers” or giving starred reviews to the package? Those were ‘sock puppet’ developer accounts that had been created on or around July 10th, the date on which the solana-trading-bot-v2 package was first posted. Each of the developer accounts had a single one repository to its name – a repo containing a single README.md file with the message “Hi there.”
Takeaway: don’t trust and verify
The lesson for developers? Don’t trust (anything). And verify. As Valentić notes in her blog post: the sophisticated campaign targeted developers plays on the widespread tendency to trust whatever can be found on platforms like GitHub – essentially deferring security assessments to the platform or the developer community at large.
Instead of doing that, developers should take a more active role in assessing the open source and commercial code they are considering implementing before integrating it into the development cycle. That means putting a skeptical eye on data like the numbers of maintainers, commits and downloads associated with a package: assessing whether a given package – and the developers behind it – are what they appear to be.
That’s especially true of developers working on blockchain and cryptocurrency applications. ReversingLabs has highlighted the large number of software supply chain attacks that target cryptocurrency software and infrastructure. RL’s threat research team and other security firms documented 23 crypto-related malicious campaigns involving malicious code being uploaded to open-source repositories in 2024 alone. That includes the December, 2024 compromise of the popular PyPI package ultralytics to deliver crypto coin miner and a campaign in April that attempted to inject a malicious payload inside locally installed software connected with the crypto community.
