OpenSourceMalware Show #22 Covers ShinyHunters, DPRK Malware and Developer Attacks
Summary
The episode covers ShinyHunters’ claimed FBI data theft, malicious Baileys packages, WeaselBiscuit malware, advisories and research on DPRK campaigns, and attacks exploiting developer workflows.
Key points
- ShinyHunters claimed it stole data from an FBI jobs website using a PeopleSoft zero-day and threatened to leak it unless the FBI retracted a prior advisory; the claim is discussed in the episode.
- Malicious Baileys typosquats can manipulate WhatsApp accounts and, in some cases, provide remote access; the hosts correct an earlier claim that the attacks targeted payments.
- WeaselBiscuit, found in 16 npm packages, is described as a stripped-down BeaverTail- and OtterCookie-derived stealer focused on keystrokes and clipboard data.
- A joint advisory cited 30,000 devices infected across more than 100 countries and cryptocurrency theft involving more than 7,000 wallets; the hosts discuss infrastructure overlap between Contagious Interview and North Korean IT-worker activity.
- Atlassian reported taking down hundreds of Contagious Interview repositories and accounts and described activity across Bitbucket, GitLab, and GitHub.
- The hosts explain how malicious repositories and developer tools can enable malware execution, and why signed commits, editor choice, and antivirus may not prevent these attacks by themselves.
Article Details
- Event Type
- Cybersecurity news roundup focused on ShinyHunters’ claimed FBI data breach and extortion threat, alongside malware research and a joint advisory on Contagious Interview.
- Impact
- ShinyHunters claims it accessed FBI job-site records using what it describes as a PeopleSoft zero-day and threatened to leak the data unless the FBI retracts a May FLASH. The hosts say the claim appears credible, but possible access to additional FBI personnel information is uncertain. The joint advisory reportedly attributed infections to Contagious Interview on 30,000 devices across more than 100 countries and tracked stolen credentials and funds from over 7,000 cryptocurrency wallets; its stated estimate of about $10.71 million in stolen crypto was questioned by the hosts as potentially incomplete. Atlassian says it has taken down hundreds of related repositories and accounts on its platform.
People
Threat Actors
Cl0pRansomware crew described by a host as having a public feud with ShinyHunters.Contagious InterviewCyber actor group discussed in a joint advisory for activity targeting IT professionals; the article says WaterPlum is a code name for Contagious Interview.ShinyHuntersCybercriminal group that claims it accessed FBI job-site records and threatened to leak data; the hosts say the claim appears credible. It also reportedly compromised a Cl0p website.WaterPlumCode name used for Contagious Interview, according to the article.
Malware
BeaverTailWeaselBiscuit: A new, stripped-down, self-contained malware family derived from BeaverTail and OtterCookie has turned up in 16 npm packages so far.OtterCookieWeaselBiscuit: A new, stripped-down, self-contained malware family derived from BeaverTail and OtterCookie has turned up in 16 npm packages so far.PolinRider[00:18:22] Paul McCarty: Because they don’t… You and I both know, they ha- they’re not talking about PolinRider, and PolinRider is part of the Contagious Interview, you know, e- evolution of what Contagious InterviewTasksJackerInterview, um, campaigns that were then reused in the early stages of PolinRider, for example, and TasksJacker.WeaselBiscuitWeaselBiscuit: A new, stripped-down, self-contained malware family derived from BeaverTail and OtterCookie has turned up in 16 npm packages so far.
Vendors
AtlassianAtlassian’s Contagious Interview research: Atlassian published research on Contagious Interview activity across Bitbucket, GitLab, and GitHub, along with the actions it has taken on its own platform.Microsoft[00:31:41] Paul McCarty: So Microsoft, DPRK sends its thanks for allowing auto, you know, tasks to run. Again, the, the, the not understanding those two things, Jenn, I think is at the heart of this, and it really does,
Products
BitbucketAtlassian’s Contagious Interview research: Atlassian published research on Contagious Interview activity across Bitbucket, GitLab, and GitHub, along with the actions it has taken on its own platform.Canvasand it is threatening to leak that data unless the FBI retracts a May FLASH tied to the Instructure Canvas breach. We cover why aging enterprise monoliths like PeopleSoft and WebLogic are such attractive targets.GitHubAtlassian’s Contagious Interview research: Atlassian published research on Contagious Interview activity across Bitbucket, GitLab, and GitHub, along with the actions it has taken on its own platform.GitLabAtlassian’s Contagious Interview research: Atlassian published research on Contagious Interview activity across Bitbucket, GitLab, and GitHub, along with the actions it has taken on its own platform.npmWeaselBiscuit: A new, stripped-down, self-contained malware family derived from BeaverTail and OtterCookie has turned up in 16 npm packages so far.PeopleSoftShinyHunters vs. the FBI and Cl0p: ShinyHunters claims it stole data from an FBI jobs website through a PeopleSoft zero-day, and it is threatening to leak that data unless the FBI retracts a May FLASH tied to theVS CodeDeveloper questions from TikTok: Our viral TikTok explainer on the VS Code tasks autorun technique drew a set of recurring questions from developers.WebLogicFLASH tied to the Instructure Canvas breach. We cover why aging enterprise monoliths like PeopleSoft and WebLogic are such attractive targets. We also get into the group’s escalating public feud with ransomware crewWhatsAppA correction on WhatsApp Baileys attacks: Malicious Baileys typosquats aren’t targeting WhatsApp payments, as we said last week.
Countries
North KoreaWe answer them, including “How this malware gets onto developer machines”, “Whether signed commits or switching editors would stop it”, “Why antivirus misses it”, and “How researchers know North Korea is behind it.”United States(PDF) North Korean “WaterPlum,” commonly referred to as “Contagious Interview,” Cyber Actor Group Targeting IT Professionals; Activities of North Korean IT Workers in Japan, the United States and Europe