Loading malware…
20 distinct techniques documented for this family, organized by ATT&CK tactic.
A cluster of malicious npm packages has been used to deliver a cross-platform remote access trojan against developers who use Alibaba-related tools.
macOS: Inserts malicious background script into ~/.zshrc and sets up a 10-minute Launch Agent.
The final aone-cli payload is a remote access trojan... It can execute shell commands, upload and download files, collect host details, stage additional payloads, and create an encrypted reverse TCP proxy.
The malware in the lib-mtop package is a classic malicious loader fetching a hardcoded remote JavaScript payload using curl, and executing it via require() from the disk.
When a developer installed one of these lookalikes, additional dependencies supplied the downloader and rule-processing components.
on Windows, it replaces the app.asar file of the Alilang security application
On macOS, it adds persistence through .zshrc and a Launch Agent
macOS: Inserts malicious background script into ~/.zshrc and sets up a 10-minute Launch Agent.
On macOS, it adds persistence through .zshrc and a Launch Agent
macOS: Inserts malicious background script into ~/.zshrc and sets up a 10-minute Launch Agent.
On macOS, it adds persistence through .zshrc and a Launch Agent
macOS: Inserts malicious background script into ~/.zshrc and sets up a 10-minute Launch Agent.
On macOS, it adds persistence through .zshrc and a Launch Agent
macOS: Inserts malicious background script into ~/.zshrc and sets up a 10-minute Launch Agent.
The attackers used a layered dependency chain in which top-level lure packages copied the names of private packages under Alibaba’s ali scope.
Additionally it performs silencing of logging mechanisms and cleanup of the malicious artifacts downloaded during previous stages of infection.
When a developer installed one of these lookalikes, additional dependencies supplied the downloader and rule-processing components.
The malicious rule abused a known escape from Node.js virtual-machine isolation.
on Windows, it replaces the app.asar file of the Alilang security application
Windows: Kills the official Alilang security app and replaces its core code (app.asar) with a Trojan copy.
The next stage profiles the host and selects a payload for macOS, Windows, or Linux.
The malware can alter Python scripts in application .skills directories so that a hidden script runs later
The malware can alter Python scripts in application .skills directories so that a hidden script runs later, offering a route for persistence and lateral movement across developer environments.
Security teams should also identify every developer workstation that installed the affected dependencies... and monitor for connections to the listed command-and-control infrastructure. Reviewing requests that use forged DingTalk Origin and Referer headers can help uncover communications tied to this threat.
It can execute shell commands, upload and download files, collect host details, stage additional payloads, and create an encrypted reverse TCP proxy.
It accessed the host process, recovered Node’s module-loading functions, and downloaded another payload from infrastructure hosted in Alibaba Cloud...
This payload is a cross-platform RAT with wide range of functionalities. These include command execution, arbitrary file upload and download
22 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.