/
← Voltar ao feed
high technology software development cloud services

DPRK-linked supply chain campaigns (ChainDrop, PolinRider) use Web3 blockchain C2 to steal cloud credentials from developer and CI/CD environments

1 fonte(s) · 1 atualização(ões) · publicado 07/10/2026 19:00 · coletado há 4 dias

Unit 42 reports that threat actors are moving supply chain malware C2 from hardcoded endpoints to Web3 mechanisms, so an entire botnet or worm infrastructure can be re-pointed with a single blockchain transaction. The ChainDrop npm worm (Shai-Hulud family, 400+ npm packages) and the PolinRider campaign (npm, Go modules, Packagist) target developer workstations and CI/CD runners to harvest cloud IAM keys, OIDC tokens and session secrets. North Korea-affiliated Alluring Pisces (aka Sapphire Sleet, Midnight Neptune) is tied to the Axios, Mastra AI and Rust arrayref supply chain compromises, linked by shared C2 beacon behavior, SSL configurations and clustered VPS ranges. Unit 42 cites its 2026 Global Incident Response Report, which identifies software supply chain compromise as a leading initial access vector against enterprise cloud environments.

Detalhes técnicos

  • Phase 1, EtherHiding: loaders issue read-only eth_call JSON-RPC queries to a hardcoded smart contract address to fetch C2 data from contract state. The fixed contract address remains a single point of failure that defenders can block.
  • Phase 2, TxDataHiding (PolinRider): encrypted C2 payloads are embedded in transaction input data (calldata), often sent to router contracts or burn addresses. Loaders read transaction history and decrypt the payload in memory. Fallback routes span TRON, Aptos and Binance Smart Chain (BSC).
  • Phase 3, NullReceiver: seen in front-end dependencies bianira-ui and fluid-type-ui. The loader queries an actor-controlled wallet for its latest zero-value transaction and derives the C2 IPv4 address from the 20-byte recipient address (ASCII marker check, leading 4 bytes converted to decimal). No contract, domain or data field exists for filters to inspect. Actors combine these methods in a hybrid design, using zero-data transfers as a backup if RPC gateways are blocked.
  • ChainDrop: a preinstall hook downloads a custom Bun runtime that launches an obfuscated credential harvester. It scans disk and the memory of running build processes for ephemeral IAM keys, CI/CD worker tokens and OIDC federation keys. It then injects persistent task hooks that fire when a developer opens a project or starts an AI coding session.
  • PolinRider: hides loaders in repository configuration files, web resources and IDE workspace automation, triggering on workspace load rather than package install scripts.
  • Axios: the lead maintainer was compromised and the backdoored dependency plain-crypto-js was injected. The payload exfiltrated cloud tokens and targeted macOS code-signing certificates.
  • Mastra AI: poisoned npm packages used build execution hooks to scrape environment variables and cloud keys.
  • Rust arrayref: the crate on crates.io was poisoned, using Rust's compilation hook to run a second-stage payload.
  • Stolen credentials may give direct access to cloud consoles and APIs, bypassing MFA if other controls are absent.

Remediação

  • Determine whether Web3 or blockchain traffic is ever legitimate in your environment. If not, treat any outbound blockchain interaction as a high-confidence anomaly and block it.
  • Deploy process-level inspection on developer workstations and CI/CD runners, and alert when non-crypto tools such as runtimes, scripting engines and compilers query public blockchain gateways.
  • Automate policy controls across CI/CD runners and version control systems to flag unauthorized changes to repository configuration files, hidden script injections in package manifests and unverified package lifecycle hooks.
  • Move from static IoC blocklists to behavioral visibility and baselining of developer traffic.

Linha do tempo

  1. unit42.paloaltonetworks.com ↗ · pub. 07/10/2026 19:00 · coletado 19/10 17:56 primeiro registro

    DPRK-linked supply chain campaigns (ChainDrop, PolinRider) use Web3 blockchain C2 to steal cloud credentials from developer and CI/CD environments

    ler a análise desta fonte

    Unit 42 reports that threat actors are moving supply chain malware C2 from hardcoded endpoints to Web3 mechanisms, so an entire botnet or worm infrastructure can be re-pointed with a single blockchain transaction. The ChainDrop npm worm (Shai-Hulud family, 400+ npm packages) and the PolinRider campaign (npm, Go modules, Packagist) target developer workstations and CI/CD runners to harvest cloud IAM keys, OIDC tokens and session secrets. North Korea-affiliated Alluring Pisces (aka Sapphire Sleet, Midnight Neptune) is tied to the Axios, Mastra AI and Rust arrayref supply chain compromises, linked by shared C2 beacon behavior, SSL configurations and clustered VPS ranges. Unit 42 cites its 2026 Global Incident Response Report, which identifies software supply chain compromise as a leading initial access vector against enterprise cloud environments.

    Technical Details

    • Phase 1, EtherHiding: loaders issue read-only eth_call JSON-RPC queries to a hardcoded smart contract address to fetch C2 data from contract state. The fixed contract address remains a single point of failure that defenders can block.
    • Phase 2, TxDataHiding (PolinRider): encrypted C2 payloads are embedded in transaction input data (calldata), often sent to router contracts or burn addresses. Loaders read transaction history and decrypt the payload in memory. Fallback routes span TRON, Aptos and Binance Smart Chain (BSC).
    • Phase 3, NullReceiver: seen in front-end dependencies bianira-ui and fluid-type-ui. The loader queries an actor-controlled wallet for its latest zero-value transaction and derives the C2 IPv4 address from the 20-byte recipient address (ASCII marker check, leading 4 bytes converted to decimal). No contract, domain or data field exists for filters to inspect. Actors combine these methods in a hybrid design, using zero-data transfers as a backup if RPC gateways are blocked.
    • ChainDrop: a preinstall hook downloads a custom Bun runtime that launches an obfuscated credential harvester. It scans disk and the memory of running build processes for ephemeral IAM keys, CI/CD worker tokens and OIDC federation keys. It then injects persistent task hooks that fire when a developer opens a project or starts an AI coding session.
    • PolinRider: hides loaders in repository configuration files, web resources and IDE workspace automation, triggering on workspace load rather than package install scripts.
    • Axios: the lead maintainer was compromised and the backdoored dependency plain-crypto-js was injected. The payload exfiltrated cloud tokens and targeted macOS code-signing certificates.
    • Mastra AI: poisoned npm packages used build execution hooks to scrape environment variables and cloud keys.
    • Rust arrayref: the crate on crates.io was poisoned, using Rust's compilation hook to run a second-stage payload.
    • Stolen credentials may give direct access to cloud consoles and APIs, bypassing MFA if other controls are absent.

    Remediation

    • Determine whether Web3 or blockchain traffic is ever legitimate in your environment. If not, treat any outbound blockchain interaction as a high-confidence anomaly and block it.
    • Deploy process-level inspection on developer workstations and CI/CD runners, and alert when non-crypto tools such as runtimes, scripting engines and compilers query public blockchain gateways.
    • Automate policy controls across CI/CD runners and version control systems to flag unauthorized changes to repository configuration files, hidden script injections in package manifests and unverified package lifecycle hooks.
    • Move from static IoC blocklists to behavioral visibility and baselining of developer traffic.