A risk actor tracked as MUT-1244 has stolen over 390,000 WordPress credentials in a large-scale, year-long marketing campaign focusing on different risk actors utilizing a trojanized WordPress credentials checker.
Researchers at Datadog Safety Labs, who noticed the assaults, say that SSH non-public keys and AWS entry keys have been additionally stolen from the compromised methods of a whole lot of different victims, believed to incorporate purple teamers, penetration testers, safety researchers, in addition to malicious actors.
The victims have been contaminated utilizing the identical second-stage payload pushed by way of dozens of trojanized GitHub repositories delivering malicious proof-of-concept (PoC) exploits that focused identified safety flaws, together with a phishing marketing campaign prompting targets to put in a faux kernel improve camouflaged as a CPU microcode replace.
Whereas the phishing emails tricked victims into executing instructions that put in the malware, the faux repositories duped safety professionals and risk actors looking for exploit code for particular vulnerabilities.
Risk actors have used faux proof-of-concept exploits previously to focus on researchers, hoping to steal useful analysis or achieve entry to the networks of cybersecurity corporations.
“Because of their naming, a number of of those repositories are mechanically included in official sources, akin to Feedly Risk Intelligence or Vulnmon, as proof-of-concept repositories for these vulnerabilities,” the researchers stated.” This will increase their look of legitimacy and the chance that somebody will run them.”
The payloads have been dropped by way of GitHub repos utilizing a number of strategies, together with backdoored configure compilation recordsdata, malicious PDF recordsdata, Python droppers, and malicious npm packages included within the initiatives’ dependencies.
As Datadog Safety Labs discovered, this marketing campaign overlaps with one highlighted in a November Checkmarkx report a few year-long supply-chain assault by which the “hpc20235/yawp” GitHub challenge was trojanized utilizing malicious code within the “0xengine/xmlrpc” npm bundle to steal knowledge and mine Monero cryptocurrency.
Malware deployed in these assaults features a cryptocurrency miner and a backdoor that helped MUT-1244 accumulate and exfiltrate non-public SSH keys, AWS credentials, setting variables, and key listing contents akin to “~/.aws.”
The second-stage payload, hosted on a separate platform, allowed the attackers to exfiltrate knowledge to file-sharing companies like Dropbox and file.io, with the investigators discovering hardcoded credentials for these platforms inside the payload, giving the attackers quick access to the stolen data.
.jpg)
“MUT-1244 was in a position to achieve entry to over 390,000 credentials, believed to be WordPress ones. We assess with excessive confidence that earlier than these credentials have been exfiltrated to Dropbox, they have been within the fingers of offensive actors, who possible acquired them by way of illicit means,” Datadog Safety Labs researchers stated.
“These actors have been then compromised by way of the yawpp device they used to examine the validity of those credentials. Since MUT-1244 marketed yawpp as a “credentials checker” for WordPress, it is no shock that an attacker with a set of stolen credentials (which are sometimes bought from underground markets as a option to velocity up risk actor operations) would use yawpp to validate them.”
The attackers efficiently exploited belief inside the cybersecurity group to compromise dozens of machines belonging to each white hat and black hat hackers after the targets unknowingly executed the risk actor’s malware, resulting in knowledge theft that included SSH keys, AWS entry tokens, and command histories.
Datadog Safety Labs estimates that a whole lot of methods stay compromised, and others are nonetheless getting contaminated as a part of this ongoing marketing campaign.
