Red-Lili

Executive Summary

Red-LILI is an active threat actor distributing malicious packages on npm and PyPI platforms. They have automated the creation of NPM users to maintain a continuous presence, with over 1500 malicious packages identified by Checkmarx SCS. Their actions pose risks to software supply chains and development ecosystems.

Goals & Targeting

Red-LILI likely aims for economic gain through ad fraud or crypto-mining, with victims primarily in the tech sector, particularly open-source developers and companies using JavaScript and Python libraries. They exploit software development tools' trust to inject malicious code into packages used globally.

Red-LILI targets software package managers, specifically npm and PyPI, deploying malicious packages that compromise the software supply chain. This activity affects developers and companies relying on these platforms. The actor's automation of user creation suggests operational sophistication and a focus on persistence. Their actions include unauthorized access to package repositories and credential extraction, potentially targeting financial gain or disrupting supply chains.

Key Capabilities

• Malicious package distribution
• Automation of user creation on npm
• Sophisticated operational security practices

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Red-LILI has sustained activity over two years, with campaigns focusing on mass-monetization. Their adaptability in creating new packages complicates detection, requiring continuous monitoring of supply chains.

IOC Patterns

• Spear-phishing via npm package updates
• Unusual spikes in PyPI downloads
• Bulk registration of npm accounts

Recommended Actions

• Monitor npm and PyPI dependencies with automated tools
• Implement strict vetting processes for new packages
• Conduct regular software supply chain audits

Suggested Tags