sukob

Executive Summary

The threat actor 'sukob' operates a sophisticated npm supply chain attack targeting Linux developer systems and CI/CD environments. The actor uses typosquatting to distribute malicious packages, harvest credentials, hijack maintainer accounts, and create long-term persistence through systemd and SUID exploitation. The campaign leverages Tor-based infrastructure for command-and-control communication, making it highly anonymous and resilient.

Goals & Targeting

'sukob' likely seeks to disrupt software development processes and gain长期 access to target environments. The targeting of Linux developer systems and CI/CD pipelines suggests a focus on sectors with high dependency on these technologies, such as technology companies, research institutions, and DevOps-heavy organizations. By compromising trusted npm packages, 'sukob' aims to create persistent footholds in victim networks while maintaining operational anonymity through Tor infrastructure.

The 'sukob' threat actor exploits the npm ecosystem by distributing a typosquatting package named 'crypto-javascri', which mimics the legitimate 'crypto-js' library. Once installed, this malicious package harvests sensitive credentials from infected systems, including those for npm and GitHub accounts. The attacker then takes over maintainer identities to republish trojanized packages under trusted names, creating a self-propagating threat within the supply chain. The payload includes a weaponized Arti Tor client that facilitatescredential theft, cryptomining, privilege escalation, and persistence mechanisms such as SUID exploitation and systemd-based services. The actor's targeting focus on Linux developer environments underscores their intent to disrupt software development pipelines and create long-term risks in the supply chain. The use of Tor-based C2 infrastructure highlights 'sukob's operational sophistication and efforts to maintain anonymity. This attack vector is particularly concerning for organizations reliant on open-source libraries and continuous integration systems.

Key Capabilities

• Typosquatting npm packages
• Credential harvesting via malware
• Maintainer account hijacking
• Automated package republishing under trusted identities
• Arti Tor client weaponization for C2 communication
• SUID exploitation for privilege escalation
• Systemd-based persistence mechanisms
• Crypto-mining capabilities

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

'sukob' campaign exhibits a worm-like propagation model, leveraging compromised maintainer accounts to distribute malicious packages further. The use of Tor infrastructure indicates a focus on long-term operational resilience and匿名ity. Targeted sectors include Linux developers, CI/CD environments, and open-source software maintainers. Notable past operations include the widespread compromise of npm packages, creating significant supply chain risks for numerous organizations.

IOC Patterns

• Spear-phishing with typosquatting npm packages
• C2 communication via Tor infrastructure
• Unusual activity in npm package repositories
• Systemd services added without proper authentication
• Abnormal credential theft patterns in system logs

Recommended Actions

• Implement rigorous supply chain security measures for npm packages.
• Monitor for unauthorized package updates or new versions of trusted libraries.
• Enable multi-factor authentication for npm and GitHub accounts.
• Harden CI/CD pipelines against supply chain compromises.
• Educate users about npm package risks and typosquatting threats.
• Conduct regular audits of system services, particularly systemd entries.
• Monitor network traffic for Tor-based C2 communication patterns.

Suggested Tags