First-ever Open-Source Software Supply Chain Attacks

Recent reports indicate that the banking sector has become the focus of threat actors utilizing an emerging supply chain attack. Two distinct incidents have been identified, with each involving unique tactics and threat actors.

Organizations implement vulnerability scanning only during the Software Development Life Cycle (SDLC) development phase, which is inadequate for the current threats organizations face.

This was the first instance where two open-source software supply-chain attacks were explicitly identified.

First Incident in Banking Sector

The first incident in early April involved a couple of npm packages that were developed and uploaded by the threat actor. These packages include a preinstall script which gets executed during installation.

The contributor of this package was linked to a LinkedIn profile which was spoofed as the employee of the targeted bank.

*Spoofed Linkedin Profile (Source: Checkmarx)*

Once the malicious package gets executed, it initially collects information about the operating system which is used for decoding relevant encrypted files.

After decoding, the encrypted files are then used to download a second-stage malicious binary.

Furthermore, VirusTotal, a widely used malware scanning tool, did not detect the Linux-specific second-stage binary.

This adds advantage to the threat actor to remain undetected and succeed in infiltration.

*VirusTotal not detecting the malware (Source: Checkmarx)*

In addition to this, the threat actor was using a subdomain in Azure which was incorporated with the name of the targeted bank. This served as a great potential attacking surface as Azure’s domains are whitelisted by default.

Finally, the attacker used the Havoc Framework for the second stage of the attack. Havoc Framework was developed by @C5pider which is an advanced post-exploitation framework capable of management, coordination, and modification of attacks.

*Summary of the attack (Source: Checkmarx)*

Second Incident

The second attack was in February 2023 in which another bank was targeted by a different threat group completely irrelevant to the April attack.

However, this attack also involved a masterfully crafted NPM package that is designed in such a way that it lies inactive on the login page of the bank and doesn’t act unless triggered.

Further investigations revealed that the payload had a unique Element ID in the HTML of the login page and attached itself to a specific login form element which prevents it from getting detected and collecting login data.

Later, the element was traced back to a mobile login page of the bank which was the prime target of the threat actors.