A threat actor known as Stargazer Goblin has set up a network of inauthentic GitHub accounts to fuel a Distribution-as-a-Service (DaaS) that propagates a variety of information-stealing malware and netting them $100,000 in illicit profits over the past year.
The network, which comprises over 3,000 accounts on the cloud-based code hosting platform, spans thousands of repositories that are used to

A threat actor known as Stargazer Goblin has set up a network of inauthentic GitHub accounts to fuel a Distribution-as-a-Service (DaaS) that propagates a variety of information-stealing malware and netting them $100,000 in illicit profits over the past year.

The network, which comprises over 3,000 accounts on the cloud-based code hosting platform, spans thousands of repositories that are used to share malicious links or malware, per Check Point, which has dubbed it "Stargazers Ghost Network."

Some of the malware families propagated using this method include Atlantida Stealer, Rhadamanthys, RisePro, Lumma Stealer, and RedLine, with the bogus accounts also engaged in starring, forking, watching, and subscribing to malicious repositories to give them a veneer of legitimacy.

The network is believed to have been active since August 2022 in some preliminary form, although an advertisement for the DaaS wasn't spotted in the dark until early July 2023.

"Threat actors now operate a network of 'Ghost' accounts that distribute malware via malicious links on their repositories and encrypted archives as releases," security researcher Antonis Terefos explained in an analysis published last week.

"This network not only distributes malware but also provides various other activities that make these 'Ghost' accounts appear as normal users, lending fake legitimacy to their actions and the associated repositories."

Different categories of GitHub accounts are responsible for distinct aspects of the scheme in an attempt to make their infrastructure more resilient to takedown efforts by GitHub when malicious payloads are flagged on the platform.

  
These include accounts that serve the phishing repository template, accounts providing the image for the phishing template, and accounts that push malware to the repositories in the form of a password-protected archive masquerading as cracked software and game cheats.

Should the third set of accounts be detected and banned by GitHub, Stargazer Goblin moves to update the first account's phishing repository with a new link to a new active malicious release, thereby allowing the operators to move forward with minimal disruption.

Besides liking new releases from multiple repositories and committing changes to the README.md files to modify the download links, there is evidence to suggest that some accounts part of the network have been previously compromised, with the credentials likely obtained via stealer malware.

"Most of the time, we observe that Repository and Stargazer accounts remain unaffected by bans and repository takedowns, whereas Commit and Release accounts are typically banned once their malicious repositories are detected," Terefos said.

"It's common to find Link-Repositories containing links to banned Release-Repositories. When this occurs, the Commit account associated with the Link-Repository updates the malicious link with a new one."

One of the campaigns discovered by Check Point involves the use of a malicious link to a GitHub repository that, in turn, points to a PHP script hosted on a WordPress site and delivers an HTML Application (HTA) file to ultimately execute Atlantida Stealer by means of a PowerShell script.

Other malware families propagated via the DaaS are Lumma Stealer, RedLine Stealer, Rhadamanthys, and RisePro. Check Point further noted that the GitHub accounts are part of a larger DaaS solution that operates similar ghost accounts on other platforms such as Discord, Facebook, Instagram, X, and YouTube.

"Stargazer Goblin created an extremely sophisticated malware distribution operation that avoids detection as GitHub is considered a legitimate website, bypasses suspicions of malicious activities, and minimizes and recovers any damage when GitHub disrupts their network," Terefos said.

"Utilizing multiple accounts and profiles performing different activities from starring to hosting the repository, committing the phishing template, and hosting malicious releases, enables the Stargazers Ghost Network to minimize their losses when GitHub performs any actions to disturb their operations as usually only one part of the whole operation is disrupted instead of all the involved accounts."

The development comes as unknown threat actors are targeting GitHub repositories, wiping their contents, and asking the victims to reach out to a user named Gitloker on Telegram as part of a new extortion operation that has been ongoing since February 2024.

The social engineering attack targets developers with phishing emails sent from "notifications@github.com," aiming to trick them into clicking on bogus links under the guise of a job opportunity at GitHub, following which they are prompted to authorize a new OAuth app that erases all the repositories and demands a payment in exchange for restoring access.

It also follows an advisory from Truffle Security that it's possible to access sensitive data from deleted forks, deleted repositories, and even private repositories on GitHub, urging organizations to take steps to secure against what it's calling a Cross Fork Object Reference (CFOR) vulnerability.

"A CFOR vulnerability occurs when one repository fork can access sensitive data from another fork (including data from private and deleted forks)," Joe Leon said. "Similar to an Insecure Direct Object Reference, in CFOR users supply commit hashes to directly access commit data that otherwise would not be visible to them."

In other words, a piece of code committed to a public repository may be accessible forever as long as there exists at least one fork of that repository. On top of that, it could also be used to access code committed between the time an internal fork is created and the repository is made public.

It's however worth noting that these are intentional design decisions taken by GitHub, as noted by the company in its own documentation -

*   Commits to any repository in a fork network can be accessed from any repository in the same fork network, including the upstream repository
*   When you change a private repository to public, all the commits in that repository, including any commits made in the repositories it was forked into, will be visible to everyone.

"The average user views the separation of private and public repositories as a security boundary, and understandably believes that any data located in a private repository cannot be accessed by public users," Leon said.

"Unfortunately, \[...\] that is not always true. What's more, the act of deletion implies the destruction of data. As we saw above, deleting a repository or fork does not mean your commit data is actually deleted."

Found this article interesting? Follow us on Twitter __ and LinkedIn to read more exclusive content we post.

'Stargazer Goblin' Creates 3,000 Fake GitHub Accounts for Malware Spread

A large text-message phishing attack campaign attributed to the China-based Smishing Triad employs malicious iMessages.

Image Source: dbtravel via Alamy Stock Photo

A China-based hacking group known as Smishing Triad has waged text message-borne phishing attacks against individuals in India, using the country's government-operated postal system as a lure.

The threat actors are targeting iPhone users with text messages falsely claiming that a package is awaiting collection at an India Post warehouse. The deceptive messages contain URLs leading to fraudulent websites.

According to a new Fortinet FortiGuard Labs report, between January and July 2024, more than 470 domain registrations were mimicking India Post's official domain, with the majority registered via Chinese and American domain registrars.

Researchers at FortiGuard Labs discovered phishing emails sent via iMessage using third-party email addresses like Hotmail, Gmail, and Yahoo. Apple ID accounts configured with these third-party emails send the malicious messages containing short URLs that direct recipients to the fraudulent websites.

**Text Phishing Goes Postal**

India Post is just the latest mail service to face mobile phishing attacks. The US Postal Service (USPS) recently found its name abused in smishing attacks orchestrated by a single threat actor based in Tehran. Another recent smishing attack aimed at US citizens informed them they had unpaid road tolls, with the aim of coercing targets into giving up their bank information.

Stephen Kowski, field CTO at SlashNext Email Security+, says the India Post phishing campaign highlights the evolving tactics of threat actors.

"They are now leveraging trusted communication channels like iMessage to deceive victims, underscoring the need for comprehensive mobile Web threat protection that can detect and block malicious URLs, even when wrapped in encrypted messages," he says.

As SMS- and other text-based attacks become increasingly sophisticated, organizations must prioritize educating their users on how to identify and report suspicious messages, he notes. "They must also implement robust security measures that can inspect and mitigate threats in real-time, regardless of the communication channel used."

By extending security controls to the mobile Web, organizations can better protect their users from these types of attacks, even when they occur outside of traditional network perimeters.

**"Mobile First" Attacks Rise**

Mobile devices are a prime target for phishing campaigns, given the amount of phishing vectors available to attackers, be it SMS, QR codes, third-party communication apps, or personal email.

This, combined with a relative false sense of security most users and organizations have on mobile, and a lack of active security controls, make mobile phishing campaigns a low risk, high reward for attackers for both personal and corporate information.

Krishna Vishnubhotla, vice president of product strategy at Zimperium, says this type of "mobile first" attack is something that is occurring more and more every day.

"Cybercriminals and hackers have begun to realize that there's a false sense of security with mobile devices, particularly those on iOS," he says.

Users tend to be less careful on their mobile devices than on a standard computer or laptop, and they rarely have proper security controls in place on their mobile devices.

"Our own research has shown a significant rise recently in mobile-targeted phishing attacks that only fully execute the attack when the link is clicked from a mobile device," he says. "Users must be on guard for anything that appears unusual, especially related to a text message or SMS."

He advises companies to have strong mobile endpoint protection defenses on employee phones to protect against exactly this type of attack, or worse.

**About the Author(s)**

Nathan Eddy is a freelance journalist and award-winning documentary filmmaker specializing in IT security, autonomous vehicle technology, customer experience technology, and architecture and urban planning. A graduate of Northwestern University’s Medill School of Journalism, Nathan currently lives in Berlin, Germany.

China-Backed Phishing Attack Targets India Postal System Users

French judicial authorities, in collaboration with Europol, have launched a so-called "disinfection operation" to rid compromised hosts of a known malware called PlugX.
The Paris Prosecutor's Office, Parquet de Paris, said the initiative was launched on July 18 and that it's expected to continue for "several months."
It further said around a hundred victims located in France, Malta, Portugal,

Malware / Cyber Intelligence

French judicial authorities, in collaboration with Europol, have launched a so-called "disinfection operation" to rid compromised hosts of a known malware called PlugX.

The Paris Prosecutor's Office, Parquet de Paris, said the initiative was launched on July 18 and that it's expected to continue for "several months."

It further said around a hundred victims located in France, Malta, Portugal, Croatia, Slovakia, and Austria have already benefited from the cleanup efforts.

The development comes nearly three months after French cybersecurity firm Sekoia disclosed it sinkhole a command-and-control (C2) server linked to the PlugX trojan in September 2023 by spending $7 to acquire the IP address. It also noted that nearly 100,000 unique public IP addresses have been sending PlugX requests daily to the seized domain.

PlugX (aka Korplug) is a remote access trojan (RAT) widely used by China-nexus threat actors since at least 2008, alongside other malware families like Gh0st RAT and ShadowPad.

The malware is typically launched within compromised hosts using DLL side-loading techniques, allowing threat actors to execute arbitrary commands, upload/download files, enumerate files, and harvest sensitive data.

"This backdoor, initially developed by Zhao Jibin (aka. WHG), evolved throughout the time in different variants," Sekoia said earlier this April. "The PlugX builder was shared between several intrusion sets, most of them attributed to front companies linked to the Chinese Ministry of State Security."

Over the years, it has also incorporated a wormable component that enables it to be propagated via infected USB drives, effectively bypassing air-gapped networks.

Sekoia, which devised a solution to delete PlugX, said variants of the malware with the USB distribution mechanism come with a self-deletion command ("0x1005") to remove itself from the compromised workstations, although there is currently no way to remove it from the USB devices itself.

"Firstly, the worm has the capability to exist on air-gapped networks, which makes these infections beyond our reach," it said. "Secondly, and perhaps more noteworthy, the PlugX worm can reside on infected USB devices for an extended period without being connected to a workstation."

Given the legal complications involved in remotely wiping the malware off the systems, the company further noted that it's deferring the decision to national Computer Emergency Response Teams (CERTs), law enforcement agencies (LEAs), and cybersecurity authorities.

"Following a report from Sekoia.io, a disinfection operation was launched by the French judicial authorities to dismantle the botnet controlled by the PlugX worm. PlugX affected several million victims worldwide," Sekoia told The Hacker News. "A disinfection solution developed by the Sekoia.io TDR team was proposed via Europol to partner countries and is being deployed at this time."

"We are pleased with the fruitful cooperation with the actors involved in France (section J3 of the Paris Public Prosecutor's Office, Police, Gendarmerie and ANSSI) and internationally (Europol and police forces of third countries) to take action against long-lasting malicious cyber activities."

Found this article interesting? Follow us on Twitter __ and LinkedIn to read more exclusive content we post.

French Authorities Launch Operation to Remove PlugX Malware from Infected Systems

Cybersecurity researchers have discovered a malicious package on the Python Package Index (PyPI) repository that targets Apple macOS systems with the goal of stealing users' Google Cloud credentials from a narrow pool of victims.
The package, named "lr-utils-lib," attracted a total of 59 downloads before it was taken down. It was uploaded to the registry in early June 2024.
"The malware uses a

Cybersecurity / Cloud Security

Cybersecurity researchers have discovered a malicious package on the Python Package Index (PyPI) repository that targets Apple macOS systems with the goal of stealing users' Google Cloud credentials from a narrow pool of victims.

The package, named "lr-utils-lib," attracted a total of 59 downloads before it was taken down. It was uploaded to the registry in early June 2024.

"The malware uses a list of predefined hashes to target specific macOS machines and attempts to harvest Google Cloud authentication data," Checkmarx researcher Yehuda Gelb said in a Friday report. "The harvested credentials are sent to a remote server."

An important aspect of the package is that it first checks if it has been installed on a macOS system, and only then proceeds to compare the system's Universally Unique Identifier (UUID) against a hard-coded list of 64 hashes.

If the compromised machine is among those specified in the predefined set, it attempts to access two files, namely application\_default\_credentials.json and credentials.db, located in the ~/.config/gcloud directory, which contain Google Cloud authentication data.

The captured information is then transmitted over HTTP to a remote server "europe-west2-workload-422915\[.\]cloudfunctions\[.\]net."

Checkmarx said it also found a fake profile on LinkedIn with the name "Lucid Zenith" that matched the package's owner and falsely claimed to be the CEO of Apex Companies, suggesting a possible social engineering element to the attack.

Exactly who is behind the campaign is currently not known. However, it comes more than two months after cybersecurity firm Phylum disclosed details of another supply chain attack involving a Python package called "requests-darwin-lite" that was also found to unleash its malicious actions after checking the UUID of the macOS host.

These campaigns are a sign that threat actors have prior knowledge of the macOS systems they want to infiltrate and are going to great lengths to ensure that the malicious packages are distributed only to those particular machines.

It also speaks to the tactics malicious actors employ to distribute lookalike packages, aiming to deceive developers into incorporating them into their applications.

"While it is not clear whether this attack targeted individuals or enterprises, these kinds of attacks can significantly impact enterprises," Gelb said. "While the initial compromise usually occurs on an individual developer's machine, the implications for enterprises can be substantial."

Found this article interesting? Follow us on Twitter __ and LinkedIn to read more exclusive content we post.

Malicious PyPI Package Targets macOS to Steal Google Cloud Credentials

Google says it recently fixed an authentication weakness that allowed crooks to circumvent email verification needed to create a Google Workspace account, and leverage that to impersonate a domain holder to third-party services that allow logins through Google's "Sign in with Google" feature.

**Google** says it recently fixed an authentication weakness that allowed crooks to circumvent the email verification required to create a **Google Workspace** account, and leverage that to impersonate a domain holder at third-party services that allow logins through Google’s “Sign in with Google” feature.

Last week, KrebsOnSecurity heard from a reader who said they received a notice that their email address had been used to create a potentially malicious Workspace account that Google had blocked.

“In the last few weeks, we identified a small-scale abuse campaign whereby bad actors circumvented the email verification step in our account creation flow for Email Verified (EV) Google Workspace accounts using a specially constructed request,” the notice from Google read. “These EV users could then be used to gain access to third-party applications using ‘Sign In with Google’.”

In response to questions, Google said it fixed the problem within 72 hours of discovering it, and that the company has added additional detection to protect against these types of authentication bypasses going forward.

**Anu Yamunan**, director of abuse and safety protections at Google Workspace, told KrebsOnSecurity the malicious activity began in late June, and involved “a few thousand” Workspace accounts that were created without being domain-verified.

Google Workspace offers a free trial that people can use to access services like Google Docs, but other services such as Gmail are only available to Workspace users who can validate control over the domain name associated with their email address. The weakness Google fixed allowed attackers to bypass this validation process. Google emphasized that none of the affected domains had previously been associated with Workspace accounts or services.

“The tactic here was to create a specifically-constructed request by a bad actor to circumvent email verification during the signup process,” Yamunan said. “The vector here is they would use one email address to try to sign in, and a completely different email address to verify a token. Once they were email verified, in some cases we have seen them access third party services using Google single sign-on.”

Yamunan said none of the potentially malicious workspace accounts were used to abuse Google services, but rather the attackers sought to impersonate the domain holder to other services online.

In the case of the reader who shared the breach notice from Google, the imposters used the authentication bypass to associate his domain with a Workspace account. And that domain was tied to his login at several third-party services online. Indeed, the alert this reader received from Google said the unauthorized Workspace account appears to have been used to sign in to his account at **Dropbox**.

Google said the now-fixed authentication bypass is unrelated to a recent issue involving cryptocurrency-based domain names that were apparently compromised in their transition to Squarespace, which last year acquired more than 10 million domains that were registered via Google Domains.

On July 12, a number of domains tied to cryptocurrency businesses were hijacked from Squarespace users who hadn’t yet set up their Squarespace accounts. Squarespace has since published a statement blaming the domain hijacks on “a weakness related to OAuth logins”, which Squarespace said it fixed within hours.

Crooks Bypassed Google’s Email Verification to Create Workspace Accounts, Access 3rd-Party Services

Several vendors for consumer and enterprise PCs share a compromised crypto key that should never have been on the devices in the first place.

Source: Lim Yong Hian via Shutterstock

Attackers can bypass the Secure Boot process on millions of Intel and ARM microprocessor-based computing systems from multiple vendors, because they all share a previously leaked cryptographic key used in the device startup process.

The so-called Platform Key (PK) from American Megatrends International (AMI) serves as the root of trust during the Secure Boot PC startup chain, and verifies the authenticity and integrity of a device's firmware and boot software.

Unfortunately, researchers from firmware security vendor Binarly discovered that the key had been publicly exposed in a data leak back in 2018. "This key was likely included in \[AMI's\] reference implementation with the expectation that it would be replaced with another safely generated key by downstream entities in the supply chain," Binarly said in a posting on the issue this week.

**The PKFail Secure Boot Issue**

What appears to have happened is that an original equipment manufacturer (OEM) used the AMI test key for firmware it produced for different Intel and ARM-based device makers. The result is there are potentially millions of consumer and enterprise devices around the world that are currently using the same compromised AMI PK during the secure bootup process, says Alex Matrosov, CEO and founder of Binarly. Affected vendors include Lenovo, HP, Asus and SuperMicro.

"An attacker with access to the private part of the PK can easily bypass Secure Boot by manipulating the Key Exchange Key database, the Signature Database, and the Forbidden Signature Database," says Matrosov, who has dubbed the issue as "PKFail." The issue makes it easier for attackers to, among other things, deploy Unified Extensible Firmware Interface (UEFI) bootkits like last year's BlackLotus, which offer persistent kernel access and privileges.

"The fix is easy: the compromised key needs to be replaced, and device vendors need to ship a firmware update," Matrosov says. Several have already done so, he notes. However, in many cases — as with data center servers, for instance, or for systems used in critical applications — the firmware updates could take some time to be deployed.

"Exploitation of this issue is trivial in the case that the device is impacted," he says, pointing to a proof-of-concept exploit (PoC) that Binarly developed for PKFail. Matrosov recommends that organizations disconnect devices with the leaked AMI PK from critical networks until they are able to deploy a firmware upgrade.

**A Master Key and a Really Big Deal**

The PKfail issue is a big deal because it makes it easy for hackers to bypass Secure Boot, which is like having a master key that unlocks many houses, said Rogier Fischer, CEO of Netherlands-based Hadrian in an emailed comment. "Since the same keys are used across different devices, one breach can affect many systems, making the problem widespread," he said.

PKFail is the only the latest manifestation of a problem that has been around for more than a decade, which is the tendency by OEMs and device-makers to use non-production and test cryptographic keys in production firmware and devices, Matrosov says. The AMI PK for instance was clearly meant to be treated as completely untrusted, and yet it ended up in devices from multiple vendors.

Binarly's report pointed to an incident in 2016 tracked as CVE-2016-5247, where security researchers discovered multiple Lenovo devices that shared the same AMI test PK. At the time, the National Vulnerability Database described the issue as allowing "local users or physically proximate attackers to bypass the Secure Boot protection mechanism by leveraging an AMI test key."

Ultimately, PKFail is a manifestation of poor cryptographic key management practices in the device supply chain, Binarly said in its report.

"This is a huge problem," Matrosov says. "If you think about an apartment complex where all the door locks have the same keys. If one key goes missing, it could create problems for everyone."

**About the Author(s)**

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year career at Computerworld, Jai also covered a variety of other technology topics, including big data, Hadoop, Internet of Things, e-voting, and data analytics. Prior to Computerworld, Jai covered technology issues for The Economic Times in Bangalore, India. Jai has a Master's degree in Statistics and lives in Naperville, Ill.

Millions of Devices Vulnerable to 'PKFail' Secure Boot Bypass Issue

Researchers track the healthcare sector as experiencing the biggest financial losses, with banking and transportation following close behind.

Source: SOPA Images Limited via Alamy Stock Photo

As the CrowdStrike Falcon outage story continues to unfold, the monetary losses to businesses from the global incident continue to rise: The volume is likely to reach $5.4 billion in costs for Fortune 500 companies, according to a report from Parametrix.

Parametrix researchers have found that roughly 25% of Fortune 500 companies experienced disruptions due to the incident, the most heavily affected industries financially being healthcare ($1.94 billion in estimated losses) and banking ($1.15 billion). In addition, a shocking 100% of the transportation and airlines sector was affected, and the group will rack up an estimated $0.86 billion in losses, according to the forecast. The $5.4 billion estimate excludes Microsoft.

The researchers noted that the outage impact to some industries, like software and IT-related services, is more likely to cause a "ripple effect beyond Fortune 500 companies," though hard numbers were not quantified in the report.

Parametrix previously detailed how the cloud acted as the catalyst for the widespread impact of the outage, and said that "the event highlights the critical dependency of major corporations on cloud services, and the systemic risks posed by such disruptions." To prevent future losses, the new report encourages cyber insurers and risk-assessors to concentrate on mapping, managing, and assessing cloud-based service provider exposure; and stressed that it's important to take a broad view, and not rely solely on the CrowdStrike event as a primary reference for "modeling future system failures involving cloud-based service providers."

**About the Author(s)**

CrowdStrike Outage Losses Estimated at a Staggering $5.4B

The campaign is laser-targeted, bucking the trend of "spray-and-pray" malicious open source packages turning up in code repositories seemingly every other day.

Source: Penta Springs Limited via Alamy Stock Photo

Researchers have come across a rather odd Python code package online that aims to steal Google Cloud Platform credentials from a very limited set of macOS victims.

The package, "lr-utils-lib," was uploaded to the Python Package Index (PyPi) early in June, and conceals its malicious code in the setup file, Checkmarx explained in a blog post on July 26 — thus allowing it to execute right away upon installation. Then, the code checks that it's running on a macOS system, and if so, checks the system's IOPlatformUUID, which is the value used to identify a particular Mac computer.

It turns out that the malware is highly targeted, only looking to infect a predetermined list of 64 specific machines. Further information about those machines, and the attacker targeting them, is unknown at this point, but it's worth noting that the package's name is very close to that of a legitimate package called "lr-utils," which is widely used in deep learning and neural networks applications, and to download large data sets. Dark Reading has sent a request for comment to Checkmarx to see if this could give a sense of the possible targets of the campaign.

In any event, from those machines, lr-utils-lib attempts to exfiltrate Google Cloud Platform credentials to a remote server, with the potential for follow-on attacks on cloud assets, including data theft, malware implantation, and the introduction of vulnerable components into the environment that can be exploited for lateral movement. As Ross Bryant, head of research at Phylum, explains, "The risk is obvious. Anyone who has your digital credentials effectively has all your rights and privileges."

Another interesting aspect of the campaign involves social engineering. The package owner goes by the name "Lucid Zenith," and apparently claims to be the CEO of a legitimate organization — Apex Companies LLC — on LinkedIn. There is also another LinkedIn profile belonging to the real CEO of the company, but the fake page is apparently so convincing that some AI platforms, including Perplexity, incorrectly stated that Lucid Zenith is the true CEO of the company, Checkmarx noted.

"We queried various AI-powered search engines and chatbots to learn more about Lucid Zenith’s position," according to the post. "What we found was a variety of inconsistent responses."

It added, "This was quite shocking since the AI-powered search engine could have easily confirmed the fact by checking the official company page, or even noticing that there were two LinkedIn profiles claiming the same title."

**Targeted Package Attacks: A Rare Phenomenon**

Malicious packages are utterly commonplace, masquerading as legitimate and useful software components while hiding their true nature. And more often than not, that true nature involves data theft. And because open source software (OSS) is, by definition, open to anyone, it's typically a good way to breach a wide variety of targets across regions.

This campaign stands out, Bryant explains, because OSS is being used in a highly targeted manner; however, there is limited precedent for the approach. For instance, "the malicious npm packages that we have seen associated with North Korean activity appear to be highly targeted," he says. Each package has unique identifiers which we attribute to individual targets. Once the victim has been compromised, the attacker immediately unpublishes the package, leaving behind almost no trace. This has been effective enough to steal billions of dollars worth of cryptocurrency."

Dark Reading has reached out to Checkmarx for more information about lr-utils-lib, including its current status. At the time of writing, a search for it on PyPi yielded no results, but it can still threaten those who have already imported it into their projects.

To mitigate the risk that your organization unwittingly accepts one of these laser-targeted packages, "Vigilance is required at every upgrade for every package and all its dependencies in an organization's software supply chain," says Bryant. "Developers should also be wary of social engineering attacks that have been very effective lately."

For its part, Checkmarx stressed that critical thinking is an invaluable asset when it comes to defending against this kind of attack. "Users should ensure they are installing packages from trusted sources and verify the contents of the setup scripts," according to the post. "The associated fake LinkedIn profile and inconsistent handling of this false information by AI-powered search engines ... serves as a reminder of the limitations of AI-powered tools for information verification, drawing parallels to issues like package hallucinations. It underscores the critical need for strict vetting processes, multi-source verification, and fostering a culture of critical thinking."

**About the Author(s)**

Nate Nelson is a freelance writer based in New York City. Formerly a reporter at Threatpost, he contributes to a number of cybersecurity blogs and podcasts. He writes "Malicious Life" -- an award-winning Top 20 tech podcast on Apple and Spotify -- and hosts every other episode, featuring interviews with leading voices in security. He also co-hosts "The Industrial Security Podcast," the most popular show in its field.

Targeted PyPi Package Steals Google Cloud Credentials from macOS Devs

The cybersecurity firm says that 97% of sensors are back online, but some organizations continue to recover, with costs tallied at $5.4 billion for the Fortune 500 alone.

Source: Sashkin via Shutterstock

A week after an ill-fated update from cybersecurity giant CrowdStrike knocked out an estimated 8.5 million Windows computers, causing problems ranging from downed medical systems at healthcare facilities to delayed flights for many airlines, organizations are still trying to restore access to their remaining affected systems.

Healthcare companies are among the most impacted organizations, with the corrupt file affecting about half of the members of the Health Information Sharing and Analysis Center (Health-ISAC), says chief security officer Errol Weiss. As of July 25, only 18% of affected organizations had fully recovered their systems, while three-quarters of companies still had as many as 25% of their systems still needing attention, Weiss says.

Many organizations had Windows-based medical devices, and now they are likely looking at a long-tailed recovery, says Weiss.

"My guess is that a lot of automated remediation was shared on Friday and Saturday — those methods probably helped a lot to get to the majority of completion," he says, referring to tools and scripts provided by Microsoft, CrowdStrike, and other companies. "But some of those scripts and automated fixes probably won't work on the kinds of devices that we're talking about, and now healthcare organizations have to take a manual look."

Microsoft released a USB Recovery Tool that gives administrators the option to use a USB drive to recover impacted systems from WinPE or safe mode. The tool may recover from safe mode even if BitLocker is enabled on a device and a recovery key is unavailable. There are also detailed recovery steps for Windows clients, servers, and operating systems hosted on Hyper-V, as well as affected Windows 365 Cloud PCs and Azure virtual machines.

**Measuring Impact of the Outage**

On July 25, CrowdStrike estimated that 97% of affected computers had returned to active status, as measured by the state of its Falcon software at the center of the outage. Managed security services provider Quest Software, whose customers span a gamut of sizes, is still offering aid to those working through the issue. The remaining companies likely represent a few hard-to-patch systems at larger firms and a large number of smaller firms that do not have the technical expertise to easily recover, says Kent Feid, senior director of product management at Quest Software.

"That 3% really represents the number of devices, and so that would equate to likely a substantial amount of small businesses still being impacted that are still somewhat unsure how to attack this," he says. "Smaller businesses tend to leverage more IT generalists or don't staff IT experts in-house."

The vast impact of the outage has still not been tallied, but insurance services firm Parametrix estimates that the event impacted a quarter of the Fortune 500 companies, with losses reaching $5.4 billion. That includes nearly $2 billion in losses for healthcare and more than $1.1 billion for the banking sector.

**Even With Tools, Many Companies Worked the Weekend**

While the recovery process is, for the most part, fairly simple, technical experts have gauged that each system requires an average of 15 minutes to recover because an administrator is required to physically access each system. In addition, companies that used BitLocker to encrypt the hard drive — a cybersecurity best practice, especially on laptop systems — would have to find the encryption key and input that key at the beginning of the process.

"There's no way to do this remotely because it has to be done in safe mode, where networking isn't working, so you can't connect to the machine remotely," says Vadim Vladimirskiy, CEO of Nerdio, a virtual desktop management firm.

At least 700 outages coincided with the bad update from CrowdStrike, with 39% of outages rated Critical. Source: Parametrix

Nerdio, which provides virtual desktops for its customers, said its customers were only minimally impacted by the failed update and its cloud desktop systems were easily repaired by recovering to a previous image. While many customers connect to Nerdio's service using a Windows computer, only the systems left on during the 78-minute window — during which the bad CrowdStrike update was distributed — were impacted. Affected customers could just switch to a different system to access their virtual desktops, limiting any impact, Vladimirskiy says.

Ironically, healthcare firms recovered by falling back on measures implemented to protect them from a threat CrowdStrike is deployed to prevent: ransomware. Health-ISAC's Weiss compiled a list of systems affected by the attack, and it includes patient services, lab collections, secure file transfers, dictation and transcription services, shipments, electronic medical records, and Medicaid and insurance billing.

"I started hearing about the impacts to these organizations and looking at the list, and it's like, 'My gosh, this sounds just like another ransomware incident,'" he says. "So that's what was going on inside healthcare on Friday for those organizations that were impacted by this. They just went, 'OK, systems are down, we're going to the manual backup procedures, we're going to paper,' and they knew what to do because they were drilling \[their response to ransomware\] in the past."

**Preventing the Next Big Failure**

The bad update also came after a significant outage of Azure services affected an above average number of companies, according to Parametrix. (On average, about 300 service disruptions occur among the Fortune 500 every day, the firm said. On Thursday, July 18, 419 coincided with the Azure outage, and on Friday, at least 700 occurred as the company dealt with the bad update from CrowdStrike.)

While CrowdStrike is feeling the market's wrath right now, the company is unlikely to be down for long because businesses need the type of services the company — and others like it — provide, says Quest Software's Feid.

"No software development company — I include ourselves in that — is perfect, right?" he says. "What's hard, I think, especially in the security industry and specifically for a company like CrowdStrike, they are being looked at and relied upon across a large part of the market to protect endpoints. ... The product is specifically designed to be ahead of the curve as much as it can, which means you can't have it both ways, consumers. There's always going to be inherent risk."

**About the Author(s)**

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline Journalism (Online) in 2003 for coverage of the Blaster worm. Crunches numbers on various trends using Python and R. Recent reports include analyses of the shortage in cybersecurity workers and annual vulnerability trends.

Companies Struggle to Recover From CrowdStrike's Crippling Falcon Update

The individual is part of a DPRK-backed group known as Andariel, which is known for using the 'Maui' ransomware strain to target and extort healthcare entities.

Source: Panther Media GmbH via Alamy Stock Photo

The US Department of Justice has unsealed an indictment of a North Korean military intelligence operative targeting US critical infrastructure.

The individual, Rom Jong Hyok, allegedly carried out ransomware attacks against healthcare facilities and funneled the ransom payments to arrange other breaches into defense, technology, and government organizations globally, in violation of the Computer Fraud and Abuse Act, according to the indictment.

The ransom payments were laundered through Hong Kong, where they were converted into Chinese yuan, withdrawn from an ATM, and then used to purchase virtual private servers in order to exfiltrate sensitive defense and technology information. 

Hyok is part of a hacking crew known as Andariel (aka APT45, Nickel Hyatt, Onyx Sleet, Silent Chollima, Stonefly, and TDrop2) and is allegedly behind cyberattacks involving a ransomware strain coined "Maui," which was targeting organizations in the US and Japan as far back as 2022. The group uses this ransomware against healthcare providers' systems and servers used for medical testing or electronic medical records.

Andariel is controlled by DPRK's military intelligence agency, the Reconnaissance General Bureau, which is involved in the DPRK's illicit arms trade and responsible for its malicious cyber acts.

"This group poses an ongoing threat to various industry sectors worldwide, including, but not limited to, entities in the United States, South Korea, Japan, and India," said the National Security Agency. 

The US Department of State's Rewards for Justice (RFJ) announced a reward of up to $10 million for information that could lead to the whereabouts of Rim Jong Hyok, Andariel, or co-conspirators.

**About the Author(s)**

Tag

#auth