PerimeterWatch | The digital security experts

Introduction

Many Python packages have been falsely advertised and contain malicious content. Cybersecurity researchers have identified these packages concealed by a Golang version of the silver commands-and-control framework within the project as a PNG image stored in the logo.

Silver C2 Framework

Silver C2 is a legitimate open-source command-and-control (C2) framework founded by the Bishop Fox security organization in 2020. Originally intended for security teams to test their hardware, this C2 framework has recently been exploited by attackers to remotely take over systems. Advanced Persistent Threat (APT) groups utilize Cobalt Strike and Metasploit for unsolicited and malicious activities.

Cobalt Strike is a commercial penetration testing tool designed for adversary simulations and red team operations for cybersecurity teams. Unfortunately, it falls into the wrong hands, so it is used for many different malicious attacks, such as phishing campaigns, evading security detection, collecting credentials through a system’s memory, and many other malicious security attacks. The Ukrainian government recently experienced an attack with Cobalt Strike when they were sent a malicious Excel sheet that would immediately take over a user’s system if the file was opened.

Malicious Python Packages

The Malicious Python Packages were hidden within the Python Package Index’s website’s logo. The package utilizing this steganographic trickery, requests-darwin-lite, was downloaded 417 times before being removed from the Python Package Index registry. The package's setup.py file decodes and executes a Base64-encoded command to gather the system's Universally Unique Identifier (UUID) on macOS systems. The package exploits the approval mechanism of the ERC20 contract (USDT), currency in the Ethereum blockchain, surreptitiously granting unrestricted approval to the attacker’s contract address. This effectively enables the attacker to siphon off the victim’s USDT tokens without their knowledge.

Recommendations

To avoid malicious C2 packages, use trusted sources such as official repositories and verified publishers, and review package data, documentation, and source code for suspicious activities. Use automated security tools like static analysis and dependency scanners. Isolate environments using virtual environments and containers and enhance network security with firewall rules and traffic monitoring. Make sure your team members are educated on risks and best practices and have an incident response plan. Regularly update dependencies and security tools to stay protected.

Conclusion

The discovery of malicious content concealed within seemingly legitimate Python packages demonstrates the challenges posed by cybersecurity threats. The exploitation of trusted frameworks like Silver C2 for iniquitous purposes shows the advancement of hackers. To reduce such risks, it is crucial for individuals and organizations to take security measures, including the use of trusted sources, thorough code review practices, and proactive security tools. By remaining vigilant and proactive in implementing robust security practices, we can better defend against emerging threats and safeguard against potential breaches and unauthorized access to sensitive data and resources.

Malicious Python Package

Introduction

Silver C2 Framework

Malicious Python Packages

Recommendations

Conclusion

Sources

Up Next

Securing Cloud Deployment in AWS, Azure, & GCP

Securing Software Supply Chain Deployments