Friday, February 7, 2025
HomeComputer SecurityHackers Abuse NuGet Packages to Deliver SeroXen RAT

Hackers Abuse NuGet Packages to Deliver SeroXen RAT

Published on

SIEM as a Service

Follow Us on Google News

The NuGet package manager, which .NET developers widely use, has been under attack by a series of malicious activities, according to a report by cybersecurity firm ReversingLabs. 

The intrusion, which follows previous investigations on npm, PyPI, and RubyGems ecosystems, shows that NuGet is also vulnerable to software supply chain attacks by threat actors.

The coordinated campaign that started in August involved attackers exploiting NuGet’s MSBuild integrations feature, demonstrating a more sophisticated and stealthy method of compromising the open-source ecosystem.

The campaign, similar to earlier attacks on npm and PyPI, shows the persistent attempts of these attackers to undermine the trust and security of software packages.

The Hidden Danger: Abusing NuGet’s MSBuild Integrations

ReversingLabs researchers have discovered a novel execution technique used by these attackers. 

Instead of using conventional methods where malicious code is embedded in initialization and post-installation PowerShell scripts, the attackers used the `<packageID>.targets` file in the “build” directory. 

This technique allows them to conceal the malicious functionality, raising alarms about the quality of open-source packages.

The discovery goes back to a package named “IAmRootDemo,” which revealed the core of this execution technique. 

By exploiting MSBuild integrations, attackers can run code embedded in inline tasks, posing a significant security risk for developers depending on external packages.

Typosquatting and Decoy Packages

The malicious packages identified by ReversingLabs, such as ZendeskApi.Client.V2, Betalgo.Open.AI, and Forge.Open.AI, are part of the same elaborate scheme initiated in August. 

These packages cleverly used typosquatting on popular NuGet packages, making them hard to distinguish from legitimate ones. 

Utilizing MSBuild integrations
Utilizing MSBuild integrations to execute malicious code in NuGet packages


Moreover, the attackers used spaces and tabs to hide the malicious code, adding another level of deception.

The Ongoing Fight for Software Supply Chain Security

This revelation highlights the urgent need for improved visibility inside software packages to differentiate between malicious and legitimate functions. 

Traditional application security testing tools face difficulties in combating these advanced attacks, requiring specialized skills and modern solutions. 

ReversingLabs Software Supply Chain Security emerges as a vital tool, filling the gaps and enabling development and application security teams to protect their supply chains from compromise.

As developers navigate the complex landscape of open-source ecosystems, vigilance and proactive security measures are essential. 

The evolving tactics of threat actors require a collaborative effort from the cybersecurity community, developers, and organizations to ensure the integrity and security of software packages. Stay tuned for further updates as the cybersecurity landscape continues to evolve.

Protect yourself from vulnerabilities using Patch Manager Plus to patch over 850 third-party applications quickly. Try a free trial to ensure 100% security.

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Autonomous LLMs Reshaping Pen Testing: Real-World AD Breaches and the Future of Cybersecurity

Large Language Models (LLMs) are transforming penetration testing (pen testing), leveraging their advanced reasoning...

Securing GAI-Driven Semantic Communications: A Novel Defense Against Backdoor Attacks

Semantic communication systems, powered by Generative AI (GAI), are transforming the way information is...

Cybercriminals Target IIS Servers to Spread BadIIS Malware

A recent wave of cyberattacks has revealed the exploitation of Microsoft Internet Information Services...

Hackers Leveraging Image & Video Attachments to Deliver Malware

Cybercriminals are increasingly exploiting image and video files to deliver malware, leveraging advanced techniques...

Supply Chain Attack Prevention

Free Webinar - Supply Chain Attack Prevention

Recent attacks like Polyfill[.]io show how compromised third-party components become backdoors for hackers. PCI DSS 4.0’s Requirement 6.4.3 mandates stricter browser script controls, while Requirement 12.8 focuses on securing third-party providers.

Join Vivekanand Gopalan (VP of Products – Indusface) and Phani Deepak Akella (VP of Marketing – Indusface) as they break down these compliance requirements and share strategies to protect your applications from supply chain attacks.

Discussion points

Meeting PCI DSS 4.0 mandates.
Blocking malicious components and unauthorized JavaScript execution.
PIdentifying attack surfaces from third-party dependencies.
Preventing man-in-the-browser attacks with proactive monitoring.

More like this

Autonomous LLMs Reshaping Pen Testing: Real-World AD Breaches and the Future of Cybersecurity

Large Language Models (LLMs) are transforming penetration testing (pen testing), leveraging their advanced reasoning...

Securing GAI-Driven Semantic Communications: A Novel Defense Against Backdoor Attacks

Semantic communication systems, powered by Generative AI (GAI), are transforming the way information is...

Cybercriminals Target IIS Servers to Spread BadIIS Malware

A recent wave of cyberattacks has revealed the exploitation of Microsoft Internet Information Services...