Threat video1:00
PolinRider Hijacks 10 npm Packages: Detection & IOCs
Hijacked npm packages read payload IPs from Ethereum transactions, then eval() XOR-encoded JavaScript. 9 detection rules, 25 IOCs and a free Splunk SPL rule.
Read the full threat intel for PolinRider Hijacks 10 npm Packages: Detection & IOCs →
Chapters
- 0:00The hook12 malicious npm releases.
- 0:04The storyLoads on require.
- 0:10Attack pathPackages harbor the loader.
- 0:22AttributionAttributed to PolinRider operators.
- 0:28Indicators of compromise20 indicators to hunt: 1 IP, 2 URLs and 3 SHA-256 hashes, and more.
- 0:37MITRE ATT&CK techniques8 ATT&CK techniques, from initial access to command and control.
- 0:42Remediation5 steps now: Search lockfiles and direct/transitive dependencies for the 12 affected releases.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:0012 malicious npm releases.
0:05Loads on require.
0:06Queries Ethereum for C2.
0:11Packages harbor the loader.
0:13Ethereum transactions hide C2.
0:15Loader fetches code and executes it.
0:18Spawns detached interactive shells.
0:23Attributed to PolinRider operators. Confidence: medium.
0:2820 indicators to hunt: 1 IP, 2 URLs and 3 SHA-256 hashes, and more.
0:378 ATT&CK techniques, from initial access to command and control.
0:425 steps now: Search lockfiles and direct/transitive dependencies for the 12 affected releases.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.