OpenSourceMalware Show #3 Covers Lazarus Git Hooks, Antrea Compromise and Active cPanel Exploitation
Summary
The episode discusses Lazarus Group’s use of Git hooks, the contested Antrea project compromise, Dirty Frag Linux privilege escalation, active cPanel exploitation, and why interpreted-language malware can evade sandboxes.
Key points
- Lazarus Group’s Contagious Interview/TaskJacker campaign still uses a VS Code task.json loader, but now uses pre-commit or post-checkout Git hooks to run malware and obscure payload URLs.
- The Antrea Kubernetes project was compromised, but the speakers said no malware had been added. The compromise’s connection to the Trivy incident is contested; they advised treating exposed credentials as compromised and rotating them.
- Dirty Frag was described as chaining two Linux page-cache write vulnerabilities for local privilege escalation to root. The episode said it was public before a patch or CVE was available.
- The speakers reported widespread active exploitation of a critical cPanel vulnerability, particularly affecting smaller organizations and local government; the episode provides no CVE or patch details.
- The discussion explains how interpreted-language malware can execute through install or import behavior and evade sandboxes through environment setup, delays, or gating.
- The speakers favored purpose-built static analysis for interpreted-language malware, while describing AI and sandboxing as useful but limited components of analysis.
Article Details
- Event Type
- Cybersecurity news and research roundup covering a malware campaign, a project compromise, Linux privilege escalation, an actively exploited cPanel vulnerability, and interpreted-language malware analysis.
- Impact
- Lazarus Group’s Contagious Interview / TaskJacker campaign uses VS Code task files and Git hooks to execute malware, while the Antrea project was compromised with no malware reported in the project at the time of the episode. Dirty Frag was described as a public Linux local privilege-escalation vulnerability chaining two page-cache write bugs. A critical cPanel vulnerability was reported as actively exploited at scale, affecting organizations including small businesses and local government. The episode also discusses how interpreted-language malware can evade sandboxes.
People
Threat Actors
Lazarus GroupIdentified in the episode as the DPRK group using Git hooks in the Contagious Interview / TaskJacker campaign.TeamPCPDiscussed in relation to the Antrea compromise; the speaker said he did not think TeamPCP was involved, while noting a trusted source suggested a possible loose affiliation.
Malware
BeaverTailthey can call out to the OS APIs to detect if they’re in a sandbox environment. You’ve documented some BeaverTail variants that are pretty sophisticated with their concealment and environment gating checks.OtterCookiethe ass, which is the reason the bad guys get saddled with this too. Before DPRK drops BeaverTail or OtterCookie, there typically are at least two batch scripts just to set up the interpreted environment. Just
Products
AntreaAntrea Kubernetes project compromise: The Antrea project, a popular Kubernetes CNI dependency, was compromised but so far no malware has been dropped into it. Paul has been tracking the threat actor and reached outcPanelcPanel actively exploited at scale: A critical actively exploited vulnerability in cPanel is hitting organizations below the security poverty line hardest. The infosec press has been quiet, but incident responders areCursorYeah. Well, it’s actually both, right? Its initial loader is still the VS Code tasks file. They have a Cursor version of it too, and it affects anything that uses VS Code, which is Windsurf and Cursor. But theDrupal[00:09:20] Paul McCarty: Well, cPanel is used by most of the low-end CMS -- WordPress, Magento, Drupal. So there is a relationship between these things. Bad guys have been using vulnerabilities in WordPress for years toJavaScriptinterpreted language malware vs. compiled malware: Most malicious open source packages are written in JavaScript or Python, and that is not an accident. Jenn and Paul walk through why: no compilation step means theMagento[00:09:20] Paul McCarty: Well, cPanel is used by most of the low-end CMS -- WordPress, Magento, Drupal. So there is a relationship between these things. Bad guys have been using vulnerabilities in WordPress for years toNode.jsgotta be able to execute. The sandbox has to be able to run the file type. NPM or PyPI requiring a full Node.js or Python runtime setup -- there’s gonna be some issues there. It’s gotta fire during the window thatNuGetMany of the effective ones work on import. And it’s not just JavaScript -- I saw Socket find six or seven NuGet packages that were doing what they said on the tin -- people would install them, see they were working,PyArmora very, very heavily obfuscated file. A lot of DPRK and other stuff in JavaScript and Python is using PyArmor. PyArmor, you need to fix your shit.Pythonlanguage malware vs. compiled malware: Most malicious open source packages are written in JavaScript or Python, and that is not an accident. Jenn and Paul walk through why: no compilation step means the attackTrivyto the maintainers. The source of compromise is contested (we have evidence it was through the March Trivy compromise), but the core takeaway stands: threat actors don’t always act immediately on stolenVS Codeshows the Contagious Interview / TaskJacker campaign has evolved. The initial loader is still the VS Code task.json file, but it now calls concatenated Git commands that drop malware via pre-commit andWindsurftasks file. They have a Cursor version of it too, and it affects anything that uses VS Code, which is Windsurf and Cursor. But the initial loader is still in the task.json file -- it just calls these twoWordPress[00:09:20] Paul McCarty: Well, cPanel is used by most of the low-end CMS -- WordPress, Magento, Drupal. So there is a relationship between these things. Bad guys have been using vulnerabilities in WordPress for years to