Threat video1:00
tw-pkgprobe-7731 npm Twilio Key Theft: Detection & IOCs
Fake Twilio bug-bounty probe tw-pkgprobe-7731 harvests env vars and Twilio keys via webhook: 19 IOCs, 9 detection rules, and a free Splunk SPL rule.
Read the full threat intel for tw-pkgprobe-7731 npm Twilio Key Theft: Detection & IOCs →
Chapters
- 0:00The hook11 versions, one fake probe.
- 0:04The storyReversingLabs found it and told npm.
- 0:10Attack pathReported: a fake Twilio probe.
- 0:21AttributionNo threat actor: this was defensive research.
- 0:26Indicators of compromise16 indicators to hunt: 1 domain, 1 URL and 11 SHA-1 hashes, and more.
- 0:33MITRE ATT&CK techniques10 ATT&CK techniques, from resource development to exfiltration.
- 0:38Remediation4 steps now: Search package-lock.json, yarn[.]lock and node_modules for tw-pkgprobe-7731 in all repositories.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:0011 versions, one fake probe.
0:05ReversingLabs found it and told npm.
0:10Reported: a fake Twilio probe.
0:13Eleven versions harvested data.
0:15Some sent Twilio credentials.
0:17Then npm removed it.
0:22No threat actor: this was defensive research.
0:2616 indicators to hunt: 1 domain, 1 URL and 11 SHA-1 hashes, and more.
0:3410 ATT&CK techniques, from resource development to exfiltration.
0:384 steps now: Search package-lock.json, yarn[.]lock and node_modules for tw-pkgprobe-7731 in all repositories.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.