Attackers exploit open source to spread malware

"Researchers note that the relatively new group TeamPCP has quickly grown into a serious threat to organizations that use cloud platforms and open-source software. The motive was primarily financial, with infected systems used for data theft, ransomware, and cryptomining."

"A key moment was the compromise of the widely used Trivy scanner, after attackers gained access to the developer's GitHub account. This allowed malicious code to be distributed via trusted software, leading to further spread when developers installed infected dependencies."

"Instead of traditional command-and-control servers, they use a system based on the Internet Computer Protocol. This allows server locations to change constantly, while infected systems remain in contact with a dynamic network."

"A notable development is the addition of a destructive component targeting Iran's systems. When the malware detects that a system is located in that region, a mechanism is activated that can render systems inoperable."

TeamPCP has emerged as a serious threat to organizations using cloud platforms and open-source software, exploiting development environments for financial gain. The group gained notoriety by attacking vulnerable cloud environments with a self-propagating worm. Recently, they compromised the Trivy scanner, allowing the distribution of malicious code via trusted software. Their malware spreads through npm, enabling further infection of projects. Uniquely, they utilize a dynamic infrastructure instead of traditional command-and-control servers. Additionally, a destructive component targets systems in Iran, disabling them instead of stealing data.

Read at Techzine Global