Cybersecurity researchers are using Typosquatted modules designed to deploy loader malware on Linux and Apple MacOS systems to warn of ongoing malicious campaigns targeting the GO ecosystem.
“The Threat Actor has published at least seven packages that are impersonating the widely used GO library, including one (GitHub)[.]Socket Researcher’s Kirill Boychenko said in a new report.
“These packages share consistent obfuscation techniques with repeated malicious file names, suggesting tuned threat actors that can pivot quickly.”
They are all still available in the official package repository, but the corresponding github repository except for “github” is[.]com/ornatedoctrin/layout says “No longer accessible. Here is the list of problematic Go packages –
shallowmulti/hypert (github.com/shallowmulti/hypert) Shadhybulk/hypert (github.com/shadowybulk/hypert) belatedplanet/hypert (github.com/belatedplanet/hypert) thanks (github.com/vainreboot/layout) ornedoctrin/layout (github.com/ornatedoctrin/layout) usilizedsun/layout (github.com/utilizedsun/layout)
The forged packages found Socket analysis contains code to enable remote code execution. This is achieved by running an obfuscated shell command to retrieve and run a script hosted on a remote server (“Alturastreet[.]ICU “). Any effort that could avoid detection will not retrieve the remote script until an hour has passed.
The ultimate goal of an attack is to install and run an executable that could steal data or credentials.
The disclosure arrived a month after the socket revealed another instance of a software supply chain attack targeting the GO ecosystem, via a malicious package that allows hostile remote access to the infected system.
“The repeated use of identical filenames, array-based string obfuscation, and delayed execution tactics strongly suggest a coordinated enemy that plans to adapt to lastingly,” Boychenko said.
“Discovering multiple malicious hyper and layout packages, along with multiple fallback domains, refers to infrastructure designed for lifetime, allowing threat actors to pivot whenever they blacklist or delete a domain or repository.”