Threat video1:00
SleepyDuck Backdoor via bee-js npm: Detection & IOCs
Poisoned bee-js 13.3.0 and Swarm Desktop 0.56.2 builds carry the SleepyDuck backdoor: 9 detection rules, 26 IOCs and a free Splunk SPL rule.
Read the full threat intel for SleepyDuck Backdoor via bee-js npm: Detection & IOCs →
Chapters
- 0:00The hookAbout 75 minutes live on npm.
- 0:04The storyThe release pipeline was abused.
- 0:11Attack pathSocket: two accounts were abused.
- 0:25AttributionAttributed to SleepyDuck.
- 0:29Indicators of compromise21 indicators to hunt: 7 IPs, 2 domains and 1 URL, and more.
- 0:37MITRE ATT&CK techniques19 ATT&CK techniques, from resource development to command and control.
- 0:43Remediation5 steps now: Search lockfiles, caches, internal registries and mirrors.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00About 75 minutes live on npm.
0:05The release pipeline was abused.
0:07Then a signed Swarm Desktop followed.
0:11Socket: two accounts were abused.
0:13Unsigned commit made a loader.
0:15The npm package went live.
0:17Swarm Desktop shipped the loader.
0:20Node config and wallet key stolen.
0:25Attributed to SleepyDuck. Confidence: medium.
0:3021 indicators to hunt: 7 IPs, 2 domains and 1 URL, and more.
0:3719 ATT&CK techniques, from resource development to command and control.
0:435 steps now: Search lockfiles, caches, internal registries and mirrors.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.