cyber.hendryadrian.com
Cyber Attack & Data Breach · darkreading.com

OVHcloud GitHub Repository Compromised to Distribute Malicious CLI Binaries

· Original article ↗

Summary

Attackers used a compromised developer GitHub account to replace OVHcloud CLI release binaries with malware that sought secrets. The files were available for 1 hour 33 minutes and downloaded about 250 times; researchers linked the attack to GlassWorm, with caveats.

Key points

  • Attackers used a compromised developer GitHub account to replace legitimate assets in OVHcloud’s open-source CLI project with malicious binaries.
  • The binaries were available for 1 hour and 33 minutes and were downloaded approximately 250 times.
  • OVHcloud removed the malicious files, corrected a release-immutability misconfiguration, and said its other repositories were unaffected.
  • The company said its production CI/CD platform runs on an internal private Git repository instance and was not affected.
  • OVHcloud urged users who downloaded the affected release to update or delete it and change secrets stored on their disks.
  • Researcher Paul McCarty linked the incident to GlassWorm via a Solana wallet address; Socket said it had not independently analyzed the October CLI binaries and had not established whether that address appeared in a later payload stage.
  • OVHcloud said the developer had installed a poisoned browser extension on a personal MacBook; Socket described behaviors consistent with GlassWorm loaders.

Article Details

Victim Organization
OVHcloud
Incident Type
Supply-chain compromise: attackers used a compromised developer GitHub account to replace assets in the ovhcloud-cli repository with malicious binaries.
Data Types Exposed
  • Secrets stored on disk were targeted for retrieval; actual exposure or theft was not confirmed.
Affected Records
The malicious binaries were downloaded approximately 250 times. The article does not report how many users were affected.
Operational Impact
Malicious binaries were available for approximately one hour and 33 minutes. OVHcloud removed them, scanned its repositories, and reported no other repositories affected; its internal production CI/CD platform was not impacted.
Ransom Or Extortion
None reported.
Claim Status
confirmed

MITRE ATT&CK

T1195.002 · Compromise Software Supply ChainAttackers replaced assets in OVHcloud's software repository with malicious binaries distributed through official releases.

People

Octave KlabaOVHcloud chairman and CEO who disclosed the incident and warned users about the malicious binaries.

Threat Actors

GlasswormThreat actors behind GlassWorm were linked to the attack by researcher Paul McCarty through a Solana wallet address; OVHcloud also said the wallet pointed to GlassWorm. Socket noted that it had not independently analyzed the October CLI binaries and had not established whether the cited address appeared in a later payload stage.

Malware

GlassWormGlassWorm threat actors appear to have snagged a big fish.

Products

OVHcloud CLIThe attackers used a compromised GitHub account for one of OVHcloud's developers to gain access to the company's ovhcloud-cli project, according to the postmortem.

Related Articles