Crypto stealers target .NET developers in new campaign

Date:
Tue, 21 Mar 2023 18:23:24 +0000

Description:
Multiple malicious packages spotted on the NuGet repository targeting .NET developers.

FULL STORY ======================================================================

.NET developers are being targeted with malware designed to steal their cryptocurrency, new reports have claimed.

Cybersecurity researchers from JFrog recently spotted an active campaign in which malicious packages were uploaded to the NuGet repository, for .NET developers to download and use.

When activated, the packages download and run a PowerShell dropper called init.ps1, which changes the endpoints settings to allow PowerShell scripts to be executed without restrictions. Custom payloads

That feature alone was enough of a red flag to warrant the packages elimination, the researchers suggest: "This behavior is extremely rare
outside of malicious packages, especially taking into consideration the "Unrestricted" execution policy, which should immediately trigger a red
flag."

Still, if allowed to operate unabated, the package will download and execute
a completely custom executable payload for the Windows environment, the researchers added. This, too, is rare behavior, the analysts said, as hackers would usually just use open-source tools to cut down on time.

To build up their legitimacy, the hackers did two things. First, they typosquatted their NuGet repository profiles, to impersonate Microsoft software developers working on the NuGet .NET package manager. Read more

Thousands of GitHub repositories are littered with malware

Supply chain attacks on open source repositories are reaching new highs

Here are the best ransomware protection tools right now

Second, they inflated the download numbers of the malicious packages to obscene highs, to make it as if the packages were legitimate and downloaded hundreds of thousands of times. While this may still be the case, the researchers said, it is more likely that they used bots to artificially inflate the numbers to catch developers off guard.

"The top three packages were downloaded an incredible amount of times this could be an indicator that the attack was highly successful, infecting a
large amount of machines," the JFrog security researchers said. "However,
this is not a fully reliable indicator of the attack's success since the attackers could have automatically inflated the download count (with bots) to make the packages seem more legitimate." Keep your business safe with the
best endpoint protection for small business

Via: BleepingComputer



======================================================================
Link to news story: https://www.techradar.com/news/crypto-stealers-target-net-developers-in-new-ca mpaign


--- Mystic BBS v1.12 A47 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)