Saturday, December 9, 2023

Hackers Abuse NuGet Packages to Deliver SeroXen RAT

The NuGet package manager, which .NET developers widely use, has been under attack by a series of malicious activities, according to a report by cybersecurity firm ReversingLabs. 

The intrusion, which follows previous investigations on npm, PyPI, and RubyGems ecosystems, shows that NuGet is also vulnerable to software supply chain attacks by threat actors.

The coordinated campaign that started in August involved attackers exploiting NuGet’s MSBuild integrations feature, demonstrating a more sophisticated and stealthy method of compromising the open-source ecosystem.

The campaign, similar to earlier attacks on npm and PyPI, shows the persistent attempts of these attackers to undermine the trust and security of software packages.

The Hidden Danger: Abusing NuGet’s MSBuild Integrations

ReversingLabs researchers have discovered a novel execution technique used by these attackers. 

Instead of using conventional methods where malicious code is embedded in initialization and post-installation PowerShell scripts, the attackers used the `<packageID>.targets` file in the “build” directory. 

This technique allows them to conceal the malicious functionality, raising alarms about the quality of open-source packages.

The discovery goes back to a package named “IAmRootDemo,” which revealed the core of this execution technique. 

By exploiting MSBuild integrations, attackers can run code embedded in inline tasks, posing a significant security risk for developers depending on external packages.

Typosquatting and Decoy Packages

The malicious packages identified by ReversingLabs, such as ZendeskApi.Client.V2, Betalgo.Open.AI, and Forge.Open.AI, are part of the same elaborate scheme initiated in August. 

These packages cleverly used typosquatting on popular NuGet packages, making them hard to distinguish from legitimate ones. 

Utilizing MSBuild integrations
Utilizing MSBuild integrations to execute malicious code in NuGet packages

Moreover, the attackers used spaces and tabs to hide the malicious code, adding another level of deception.

The Ongoing Fight for Software Supply Chain Security

This revelation highlights the urgent need for improved visibility inside software packages to differentiate between malicious and legitimate functions. 

Traditional application security testing tools face difficulties in combating these advanced attacks, requiring specialized skills and modern solutions. 

ReversingLabs Software Supply Chain Security emerges as a vital tool, filling the gaps and enabling development and application security teams to protect their supply chains from compromise.

As developers navigate the complex landscape of open-source ecosystems, vigilance and proactive security measures are essential. 

The evolving tactics of threat actors require a collaborative effort from the cybersecurity community, developers, and organizations to ensure the integrity and security of software packages. Stay tuned for further updates as the cybersecurity landscape continues to evolve.

Protect yourself from vulnerabilities using Patch Manager Plus to patch over 850 third-party applications quickly. Try a free trial to ensure 100% security.


Latest articles

Exploitation Methods Used by PlugX Malware Revealed by Splunk Research

PlugX malware is sophisticated in evasion, as it uses the following techniques to avoid...

TA422 Hackers Attack Organizations Using Outlook & WinRAR Vulnerabilities

Hackers exploit Outlook and WinRAR vulnerabilities because these widely used software programs are lucrative...

Bluetooth keystroke-injection Flaw: A Threat to Apple, Linux & Android Devices

An unauthenticated Bluetooth keystroke-injection vulnerability that affects Android, macOS, and iOS devices has been...

Atlassian Patches RCE Flaw that Affected Multiple Products

Atlassian has been discovered with four new vulnerabilities associated with Remote Code Execution in...

Reflectiz Introduces AI-powered Insights on Top of Its Smart Alerting System

Reflectiz, a cybersecurity company specializing in continuous web threat management, proudly introduces a new...

SLAM Attack Gets Root Password Hash in 30 Seconds

Spectre is a class of speculative execution vulnerabilities in microprocessors that can allow threat...

Akira Ransomware Exploiting Zero-day Flaws For Organization Network Access

The Akira ransomware group, which first appeared in March 2023, has been identified as...

Endpoint Strategies for 2024 and beyond

Converge and Defend

What's the pulse of Unified Endpoint Management and Security (UEMS) in Europe? Join us live to uncover the strategies that are defining endpoint security in the region.

Related Articles