Threat video1:00
Ethersphere bee-js 13.3.0 Compromise: Detection & IOCs
Hijacked Ethersphere release workflows shipped a wallet stealer: 26 IOCs, 20 ATT&CK techniques, 9 detection rules and a free Splunk SPL rule.
Read the full threat intel for Ethersphere bee-js 13.3.0 Compromise: Detection & IOCs →
Chapters
- 0:00The hookMalicious npm release live about 75 minutes.
- 0:04The storyCompromised accounts pushed an unsigned loader.
- 0:11Attack pathAn unsigned commit added the loader.
- 0:24AttributionAttributed to SleepyDuck.
- 0:29Indicators of compromise22 indicators to hunt: 7 IPs, 2 domains and 2 URLs, and more.
- 0:37MITRE ATT&CK techniques20 ATT&CK techniques, from resource development to command and control.
- 0:42Remediation5 steps now: Search lockfiles, caches, internal registries, mirrors and CI logs.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Malicious npm release live about 75 minutes.
0:05Compromised accounts pushed an unsigned loader.
0:08The official pipeline signed it.
0:11An unsigned commit added the loader.
0:13The release workflow published it to npm.
0:16A manual dispatch signed the desktop build.
0:19It stole Swarm node wallet files.
0:25Attributed to SleepyDuck. Confidence: high.
0:3022 indicators to hunt: 7 IPs, 2 domains and 2 URLs, and more.
0:3720 ATT&CK techniques, from resource development to command and control.
0:435 steps now: Search lockfiles, caches, internal registries, mirrors and CI logs.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.