Researchers Attribute 26 Malicious npm Packages to North Korean StegaBin Campaign
Summary
Researchers attribute 26 malicious npm packages in the StegaBin campaign to Famous Chollima. Their loader decodes C2 domains hidden in Pastebin essays, then delivers cross-platform malware for credential theft, persistence, remote control, and developer-secret exfiltr.
Key points
- The packages masquerade as developer tools and use an install.js script to execute a payload during installation.
- The loader strips zero-width characters and extracts C2 domains encoded in Pastebin essays by selecting characters at evenly spaced positions.
- Decoded C2 domains route to platform-specific payloads for Windows, macOS, and Linux across 31 Vercel deployments.
- The malware includes modules for VS Code persistence, keylogging and clipboard theft, browser and cryptocurrency-wallet credential theft, and file collection.
- Other modules scan for developer secrets with TruffleHog, collect Git credentials and SSH files, and enable remote control and data exfiltration.
- The RAT communicates with 103.106.67[.]63 on ports 1244 and 1247, according to the article.
- Socket and kmsec.uk track the activity as StegaBin and attribute it to Famous Chollima; researchers say the Pastebin steganography and multi-stage routing improve evasion.
Article Details
- Attack Vectors
- 26 malicious npm packages masqueraded as developer tools and ran install.js during installation to execute a payload.
- The loader extracted C2 domains from characters hidden at evenly spaced positions in Pastebin essays, then used Vercel-hosted infrastructure to retrieve platform-specific payloads.
- A shell script retrieved a RAT component; the RAT accepted remote instructions to change directories and execute shell commands.
- Payload modules targeted VS Code configuration for persistence, recorded keystrokes and clipboard contents, and stole browser, wallet, and iCloud Keychain credentials.
- Additional modules scanned files and Git repositories, collected SSH files and Git credentials, and exfiltrated data over FTP.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | ext-checkdin[.]vercel[.]app | Vercel-hosted C2 domain reported to serve a shell script that retrieves a RAT component. |
| IPV4 | 103[.]106[.]67[.]63 | Malware C2 address used to receive instructions and support data collection and exfiltration. |
MITRE ATT&CK
T1027.003 · SteganographyThe loader concealed C2 domain characters at evenly spaced positions in Pastebin essays and reconstructed the domains.T1048.003 · Exfiltration Over Unencrypted Non-C2 ProtocolThe RAT module exfiltrated data of interest over FTP.T1056.001 · KeyloggingThe clip module recorded keystrokes and periodically exfiltrated collected data.T1059.004 · Unix ShellA shell script retrieved the RAT, which could execute shell commands on the infected host.T1059.006 · PythonThe browser credential-stealing module bro is described as a Python payload.T1059.007 · JavaScriptThe malicious npm packages executed JavaScript through install.js and the payload included a Node.js module.T1083 · File and Directory DiscoveryThe z module enumerated the file system and selected files matching predefined patterns.T1102.001 · Dead Drop ResolverThe loader used Pastebin essays as a dead drop to retrieve hidden C2 domains.T1105 · Ingress Tool TransferThe malware fetched platform-specific payloads from decoded Vercel domains, and the shell script retrieved a RAT component.T1115 · Clipboard DataThe clip module stole clipboard contents.T1547 · Boot or Logon Autostart ExecutionThe malware used malicious VS Code tasks.json files as a persistence mechanism, triggered when a project was opened.T1552.004 · Private KeysThe git module collected files from .ssh directories, including SSH key material.T1555.001 · KeychainOn macOS, the malware targeted the iCloud Keychain.T1555.003 · Credentials from Web BrowsersPayload modules stole credentials from browser credential stores.
People
Kieran MiyamotoTracked the operation as StegaBin and commented on the campaign's use of multiple delivery techniques.Peter van der ZeeSocket researcher who described how the loader decoded C2 URLs hidden in Pastebin essays.Philipp BurckhardtSocket researcher who described how the loader decoded C2 URLs hidden in Pastebin essays.
Threat Actors
Products
npmas StegaBin and attributed to the North Korean Famous Chollima cluster — that published 26 malicious npm packages masquerading as developer tools to deliver a developer-targeted credential stealer and remotePastebinThe packages use install.js to run a steganographic loader that extracts Vercel-hosted C2 domains from Pastebin essays and fetches multi-platform payloads implementing VS Code persistence, keylogging, browser and walletVercelThe packages use install.js to run a steganographic loader that extracts Vercel-hosted C2 domains from Pastebin essays and fetches multi-platform payloads implementing VS Code persistence, keylogging, browser and walletVSCodeIt contains nine modules to facilitate Microsoft Visual Studio Code (VS Code) persistence, keylogging and clipboard theft, browser credential harvesting, TruffleHog secret scanning, and Git repository and SSH key