Threat video1:00
Miasma Worm in strutil-core RubyGem: Detection & IOCs
strutil-core's install step runs a Bun worm that harvests 51 credential stores: 9 detection rules, 23 IOCs and a free Splunk SPL rule.
Read the full threat intel for Miasma Worm in strutil-core RubyGem: Detection & IOCs →
Chapters
- 0:00The hookMalicious gem reads 51 credential stores.
- 0:04The storyIt ran during gem install.
- 0:10Attack pathA clean seed came first.
- 0:25AttributionAttributed to testmetest.
- 0:29Indicators of compromise18 indicators to hunt: 2 domains, 1 URL and 7 SHA-256 hashes, and more.
- 0:38MITRE ATT&CK techniques18 ATT&CK techniques, from initial access to impact.
- 0:43Remediation4 steps now: Isolate any host or CI runner where strutil-core.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Malicious gem reads 51 credential stores.
0:05It ran during gem install.
0:07Removed after about 5 hours.
0:11A clean seed came first.
0:13Then a trojanized build ran.
0:15It harvested 51 credential stores.
0:17Data left via a server, then GitHub.
0:20Fake hooks planted persistence.
0:25Attributed to testmetest. Confidence: low.
0:3018 indicators to hunt: 2 domains, 1 URL and 7 SHA-256 hashes, and more.
0:3918 ATT&CK techniques, from initial access to impact.
0:444 steps now: Isolate any host or CI runner where strutil-core.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.