Threat video1:00
PolinRider via AccuraSoftHire Interviews: Detection & IOCs
AccuraSoftHire's fake React test drops a PolinRider loader via Tailwind look-alikes. Includes 9 detection rules, 34 IOCs and a free Splunk SPL rule.
Read the full threat intel for PolinRider via AccuraSoftHire Interviews: Detection & IOCs →
Chapters
- 0:00The hookFake interviews delivered a malware loader.
- 0:04The storyA fake Tailwind plugin loaded.
- 0:11Attack pathFake packages carried the loader.
- 0:24AttributionAttributed to Contagious Interview.
- 0:29Indicators of compromise31 indicators to hunt: 8 IPs, 1 domain and 6 URLs, and more.
- 0:36MITRE ATT&CK techniques17 ATT&CK techniques, from resource development to command and control.
- 0:42Remediation3 steps now: Search developer machines and node_modules for the listed npm packages.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Fake interviews delivered a malware loader.
0:05A fake Tailwind plugin loaded.
0:07Then a fake camera driver.
0:11Fake packages carried the loader.
0:13It ran on a CSS build.
0:15Camera check, then Node installed.
0:17Then it ran hidden.
0:19C2 came from a wallet.
0:24Attributed to Contagious Interview. Confidence: medium.
0:2931 indicators to hunt: 8 IPs, 1 domain and 6 URLs, and more.
0:3717 ATT&CK techniques, from resource development to command and control.
0:433 steps now: Search developer machines and node_modules for the listed npm packages.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.