New malicious packages in PyPI: What it means for securing open source repositories

After a recent discovery of malicious PyPI packages, questions remain about the security community’s ability to mitigate threats posed to open source repositories.

The threat of software supply chain attacks has taken center stage in the year 2022, and a robust track record of these attacks demonstrates that there is an evergreen threat to software at large. What put software supply chain attacks on the map was SolarWinds. But more recently, the dangers associated with the use of open source repositories specifically has made itself more clear in the newer software supply chain attacks that are unfolding. 

The recent IconBurst software supply chain attack, discovered by ReversingLabs, is a perfect example of how open source repositories can unfortunately be abused by malicious actors. What we found was a widespread campaign to install malicious NPM modules capable of harvesting sensitive data from forms embedded in mobile applications and websites. Unfortunately, IconBurst is just one example of public repositories being the attack vector for threat actors. 

This week, a new attack on open source unfolded. ReversingLabs’ Robert Perica and I detected several new malicious packages in the PyPI public repository, uploaded by a separate author. Perica believes that the packages found are almost identical, differing mainly by their names. The basic functionality of these packages is also identical, in that they beacon back successful installation to the C2 server and download a stage 2 payload from the remote server. This payload can be detected by using the open source YARA rule for Parallax RAT.

The following code snippet is of the first malware stage, within the published PyPi package, that downloads the Parallax RAT executable with the file extension reserved for screensavers on Windows.

Figure 1: Python code responsible for communication with C2 server 

Figure 2: One of two user accounts used for publishing of malicious packages 

ReversingLabs reached out to PyPI’s security team about these malicious packages, and they responded soon after saying that they had removed all of the packages as of August 23rd, 2022.   

Malicious packages found on public repositories like PyPI are not a new threat, being similar to IconBurst and other supply chain attacks abusing open source software. However, what is truly alarming for the security community are the recent attacks that have been performed by automatic submission of a large number of malicious packages to open source repositories. For example, on August 19th 2022, more than 900 malicious NPM packages were submitted by a single user, demonstrating that the mass volume of these malicious packages and the abilities of threat actors to easily dump them in public repositories is a current reality. 

Figure 3: User account used for publishing of malicious npm packages

With the increasing amount of malicious packages popping up in open source repositories, the bandwidth of the security community may not be prepared to prevent open source-based software supply chain attacks from occurring. Currently, open source software libraries and components form the foundation of, by some estimates, 75% of applications. With an increasing reliance on open source packages, the attacks on these repositories has increased as well: attacks on npm and PyPI combined have surged 289% since 2018. 

The spreading of malicious packages is now not the only threat to public repositories. Today, PyPI shared on Twitter (see below) that they have received reports of a phishing campaign targeting PyPI users. They stated that this is the first known phishing campaign against PyPI, creating another realistic threat impacting open source repositories.  

While it’s clear that open source repositories enable thriving developer communities, security researchers still stand alone in detecting and mitigating these kinds of threats, since public source repositories like PyPI and npm struggle to prevent them, while at the same time never-before-seen threats are emerging. 

To learn more about the technical details of this new attack, its indicators of compromise (IoCs), and best practices for avoiding and mitigating these kinds of attacks, continue reading. 

Anatomy of the attack

As a part of this malicious campaign almost 40 PyPI packages were published to the PyPI repository from two different accounts — pypzz and pypiappz. Since all of the packages contain almost identical code shown in Figure 1, it can safely be concluded that the same actor is managing both of them. All of the packages from the same author were published in a very short period of time leading to a conclusion that some kind of automated publishing process was utilized. 

As described earlier, the functionality of these python packages is quite simple. First they beacon back to the C2 server notifying it about successful installation. After that stage2 payload is downloaded and executed on the infected machine. Download link for the stage 2 payload is hxxps://python-release.com/python-install.scr. The domain as well as package names lead to the conclusion that the malicious actor is trying to impersonate the legitimate python download website.

Figure 4: Impersonation attempt of the legitimate python download webpage

Looking at the content of the webpage hosted on this impersonation domain shows a slightly corrupt web layout. What stands out is a notice at the top of the page trying to convince the visitor into enabling javascript execution on this webpage. HTML source code of the page references a suspicious script. 

Figure 5: Reference to a suspicious jquery script

The name tries to mimic a jquery javascript file, but the content of the script is obfuscated with Javascript obfuscator (mentioned in a few of our previous blog posts). The contents of this script uncover another file hosted on this weblocation which can also be downloaded under the name python-setup.zip.   

Figure 6: Artifacts revealing usage of Javascript obfuscator 

So to quickly summarize, the python-release.com domain hosts two downloadable files python-install.scr and python-setup.zip. The first one, referenced directly from PyPI packages, contains packed Parallax RAT malware. The second one is a zip archive containing several legitimate executables signed by Python Software Foundation. But it also contains an executable named python-install.scr (the same name as the one referenced from the PyPI packages) signed with a certificate issued to M-Trans Maciej Caban organization. 

Figure 7: Valid signature of the malicious executable 

The signature is valid but the file contains malicious .NET executable in the file overlay. Behavior indicators extracted from this .NET executable reveal that it performs credential stealing from Microsoft Edge and Google Chrome local databases and exfiltrates that data to python-release.com C2 domain.

Figure 8: Behavior indicators extracted from python-install.scr payload

One of the powerful features ReversingLabs a1000 platform provides is URL analysis. It provides a way to see a history of analysis performed for some domain and to see how many different files were downloaded from that domain. In this case 4 different files were downloaded from this domain and so far, only two were covered with the current research. So it is possible that earlier in time, different files were served when the same URL was visited.

Figure 9: Behavior indicators extracted from python-install.scr payload

ReversingLabs file similarity algorithms confirm this information and enable pivoting from the original two samples to the other ones previously hosted on the same domain. One of the files discovered in this way exfiltrates data to linkedopports.com domain, which is also seen in the PyPI packages as the domain to which beaconing about successful malware installation is reported. Both of the domains have alexander surovcev under their Registrant Organization entry in their public domain record. The total list of malicious files discovered during this investigation can be found in the IoC section at the end of this blog post.   

Indicators of Compromise (IoC)

C2 domains extracted from the analyzed PyPI packages:

linkedopports.com

python-release.com

Stage 2 payloads:

b33824cafd32e7fb1a7bf01865ddac69f1ffd038

68d32e3b84c0596805f438fb1cfc1b3befba821f

1e697bc7d6a9762bfec958ee278510583039579c

567e1d5aa3a409a910631e109263d718ebd60506

0a6731eba992c490d85d7a464fded2379996d77c

d3ed1c7c0496311bb7d1695331dc8d3934fbc8ec

a30df748d43fbb0b656b6898dd6957c686e50a66

Package versions: