Researchers on Monday reported that threat actor RED-LILI has launched hundreds of malicious packages as part of node package manager (NPM) attacks on Azure and other developers.
In a blog post, researchers from Checkmarx said customarily, attackers use an anonymous disposable NPM account from which they launch their attacks. In this case, the attacker has fully-automated the process of NPM account creation and has open dedicated accounts, one per package, making the new malicious packages batch harder to spot.
The Checkmarx researchers say RED-LILI is still active and continues to publish malicious packages. About three weeks ago Checkmarx reported about an attacker experimenting in several techniques while attempting dependency confusion attacks. In the past week, research teams from JFrog and Sonatype also published blogs informing the security community about hundreds of malicious packages. All three reports from the research groups are all related to RED-LILI.
"Attackers are currently improving their techniques and building automated systems as they deploy bursts of supply chain attacks at scale, which allows them to go undetected for longer periods of time," said Jossef Harush, co-author of today’s blog and head of engineering at Checkmarx. “As this attack is still ongoing, in addition to tracking threat actors such as RED-LILI, we will continue to monitor and study the attackers to keep the open source ecosystem clean from attacks.”
Ray Kelly, fellow at NTT Application Security, added that it appears malicious actors are continuing to jump on the supply chain attack vector following the SolarWinds breach in 2021.
“Companies are struggling to keep up with all of the new attack entry points, such as NPM in this case,” Kelly said. “As these vulnerable NPM packages are pulled into a CI/CD pipeline, anything from ransomware to PII theft can be easily bundled into the software of an unsuspecting organization.”
John Bambenek, principal threat hunter at Netenrich, said attackers have been working for months with this technique to perfect it. Now by utilizing automation, they can weaponize and scale this attack to impact many more organizations.
“In getting the behavioral techniques right, it will mean there are no longer good ways to detect this for end-users so hackers will now be getting victims for nothing and their reverse shells for free,” Bambenek said.
