ChainDrop has transformed routine software installations into a method for credential theft This article explores credential theft chaindrop. . ChainDrop Worm infects 400+ npm packages.
Credential theft and containment steps include creating public repositories under victim accounts as an additional route for stolen data, while also retrieving command destinations through an Ethereum smart contract, allowing operators to change them without updating infected packages.
(Observed endpoint associated with the rotated C2 domain) IP addresses: - 104.21.91.101 (Destination IP observed for the rotated C2 domain) - 172.67.215.154 (Destination IP observed for the rotated C2 domain) Ethereum contracts: - 0xE1f2395ee43e45A1556EC6438a88c31B83493103 (Resolver contract used to supply C2 domains) - 0xc55920f1bd0531b6738153068a666c080ddded47e6256f1fd980d51c0b507c91 (Transaction used to rotate C2 infrastructure) Ethereum wallets: - 0x55f9780e1492344b7417fa723aedc4d0b97f31cd (Contract owner wallet) - 0x35477b7b2df3174B9FE8A681750A7E3fbA20F39B (Binance deposit pivot) Selectors: - 0x53ed5143 (Getter selector) - 0xd3c159e5 (Setter selector) Repository descriptions: - Shai-Hulud: Here We Go Again (Description used on public repositories linked to exfiltration activity) GitHub markers: - thebeautifulmarchoftime (Commit-search token for backup C2 mechanism) - thebeautifulsnadsoftime (Signed-record prefix for backup C2 mechanism) Repository names: - sardaukar, mentat, fremen, atreides, harkonnen Persistence artifacts/files: - ~/.local/bin/gh-token-monitor.sh (Latent Linux persistence artifact) - ~/.config/gh-token-monitor/ (Latent Linux persistence directory) - ~/Library/LaunchAgents/com.user.gh-token-monitor.plist (Latent macOS LaunchAgent persistence artifact) - ~/.config/systemd/user/gh-token-monitor.service (Latent Linux systemd persistence artifact) Integrate real-time threat intelligence from trusted sources like MISP, VirusTotal, or your SIEM to prevent potential cyber threats from compromising your business operations.
