WEBVTT
00:00:00.959 --> 00:00:13.359
It is Thursday, August 27th, and we are here with I'm going to call it breaking news out of Australia, which maybe is not a thing that we hear too often in the cybersecurity world.
00:00:13.679 --> 00:00:15.279
But uh good news.
00:00:15.679 --> 00:00:21.600
The Australian federal police arrested two individuals associated with Team PCP.
00:00:22.000 --> 00:00:27.839
Um they're two of the more uh perhaps active members, from what it sounds like.
00:00:27.920 --> 00:00:30.719
And Paul, love to hear your side of this in just a second.
00:00:30.879 --> 00:00:36.079
But just in brief, um, it's a 21-year-old and a 23-year-old.
00:00:36.240 --> 00:00:46.560
Uh Ruben Thompson and uh the other suspect was identified by ABC's court reporting to be Lewis uh Gabler.
00:00:47.359 --> 00:00:50.479
Uh you know what can I say?
00:00:50.640 --> 00:00:57.200
It on one hand, play stupid games, get stupid prizes, uh F around and find out.
00:00:57.520 --> 00:01:01.920
But also um these are two incredibly young people.
00:01:02.320 --> 00:01:08.400
Uh one of has a history of drug abuse and employment problems.
00:01:08.640 --> 00:01:13.519
The other has gotten involved in some pretty nasty neo-Nazi stuff.
00:01:13.920 --> 00:01:18.959
Uh honestly, as a parent, I hate to see two young men having gone down this path.
00:01:19.200 --> 00:01:28.159
I hope that whatever comes next for them uh gives them an opportunity to decide to do something different with their lives.
00:01:28.239 --> 00:01:30.879
They're young and they have a lot of life ahead of them, hopefully.
00:01:31.120 --> 00:01:33.120
And I hope they've learned from this.
00:01:34.239 --> 00:01:37.519
You are like you and I are just so different in this regard.
00:01:37.680 --> 00:01:39.519
Like we're both parents, right?
00:01:39.599 --> 00:01:46.400
And so I think that's an important thing to, but I am just so like I have no sympathy for them.
00:01:46.719 --> 00:01:47.599
They're drug addicts.
00:01:50.480 --> 00:01:52.640
What they did was incredibly wrong.
00:01:53.280 --> 00:01:56.319
But these are also like it's sad to see.
00:01:56.480 --> 00:02:01.760
This is not your like hardened criminal uh life of crime kind of thing.
00:02:01.840 --> 00:02:07.840
Like, these are, as we've been talking about for several months, a couple of like kind of dumb kids.
00:02:08.560 --> 00:02:14.560
Yeah, and I think that that's gonna be the theme running through today's show, which is just dumb kids.
00:02:14.719 --> 00:02:19.280
They just did a bunch of dumb stuff, which we knew uh we were calling out before they got arrested.
00:02:19.439 --> 00:02:36.879
But um, I think uh one take on that last part or that first part there before we move into the the heart of today's conversation about these guys, is that listen, I understand they're at the beginning of their lives, but they also come from what appear to be relatively well-off parents.
00:02:37.039 --> 00:02:41.599
They seem like mostly useless drifter type people.
00:02:41.759 --> 00:02:44.639
Like, listen, I was a I was a 20-year-old man, right?
00:02:44.719 --> 00:02:47.120
That was trying to figure out you know where I was.
00:02:47.199 --> 00:02:53.280
And you know what I did is I found I found a passion and I followed it and I became successful, right?
00:02:53.439 --> 00:02:55.759
So I don't have I don't, I don't no.
00:02:56.319 --> 00:03:25.360
Um maybe I'm giving well, no, I don't disagree with you because you know, I was reading uh Brian's Kreb, Brian Krebs article in detail, and I found Ruben Thompson's general attitude about the job industry to be on one hand, understandable because getting into cybersecurity is not easy, but on the other, he acted like he didn't see an alternative.
00:03:25.840 --> 00:03:29.120
And I just I have a tough time with that.
00:03:29.199 --> 00:03:38.800
You know, I know a lot of people who work hard to get into cybersecurity who have the same uh barriers that he may have had.
00:03:39.199 --> 00:03:45.919
Uh, you know, they talk in the article about, you know, if you don't have experience, employers won't look at you.
00:03:46.159 --> 00:03:49.039
There are a lot of ways to get experience.
00:03:49.840 --> 00:03:58.319
Well, you know, bad people like to latch on legitimate arguments like that to make to validate why they did what they did.
00:03:58.400 --> 00:04:09.439
And let me just start out by saying something super crazy, which is Jeffrey Dahmer, before he killed his first person, could you know it was just a 20-year-old man who hadn't done anything, right?
00:04:09.599 --> 00:04:12.639
And you know, the innate evil within him.
00:04:12.800 --> 00:04:15.439
And these two guys, I got I got no sympathy that well.
00:04:15.520 --> 00:04:19.920
I know you we neither one of us has sympathy for him, but I um I hope they throw the book at him.
00:04:20.079 --> 00:04:29.040
Um, not only do I hope they throw the book at him, um, these two young kids are just gonna, even in Australian prison, because both of them are white supremacists.
00:04:29.120 --> 00:04:38.720
That's the other thing you have like they both one of them, Casper, is more out there, but you look at some of the things that that old mate Ruben has said.
00:04:38.800 --> 00:04:54.639
He comes from South African, he comes from a he comes from a I don't think he comes from a Boer background, but I think he comes from an Anglo background in South Africa and is very um, you know, entrenched in that kind of white supremacist, Anglo-nationalistic.
00:04:54.800 --> 00:04:58.079
And yeah, they've said some pretty nasty things.
00:04:58.319 --> 00:05:05.040
It's there's a there's there's this growing movement, and I don't want to give it too much play here, but there's this growing movement called re migration, right?
00:05:05.120 --> 00:05:10.639
Which is just a fancy word for racist white supremacist nationalists, and there is some overlap.
00:05:10.959 --> 00:05:20.800
Um, last night a um a journalist was pinging me some stuff about some of the remigration things happening here, and there's a connection between that and some of these like South African folks.
00:05:20.959 --> 00:05:23.360
Um, anyhow, more to be discussed later on.
00:05:23.519 --> 00:05:25.120
Let's jump into the heart of this, Jen.
00:05:25.199 --> 00:05:25.920
Let's get her on.
00:05:26.160 --> 00:05:28.399
Well, so where do you want to start with it?
00:05:28.639 --> 00:05:37.360
Because uh there's plenty to discuss from the Krebs article, from the uh AFP uh press release.
00:05:37.600 --> 00:05:46.639
I know you have been uh talking to people behind the scenes for multiple months, I want to say.
00:05:46.800 --> 00:05:50.480
Uh, so you you know kind of knew this was coming.
00:05:50.879 --> 00:05:53.360
Um what do you want to discuss?
00:05:53.680 --> 00:05:57.600
Yeah, I mean, I like uh, you know, I was preview to some inside baseball.
00:05:57.759 --> 00:06:03.680
Um, you know, and I don't want to go into a lot of details because I don't want to, you know, I don't want to be part of inside baseball in the future.
00:06:04.000 --> 00:06:19.279
Yeah, you know, I want, but but the reality is that um I had some intel that you know one of these people was perhaps in my country, um, and um, you know, some meetings took place because of that.
00:06:19.439 --> 00:06:25.519
But um, I think the first thing I want to say start out by saying is that listen, we were right, we called it, right?
00:06:25.680 --> 00:06:30.160
Like basically, team PCB is one guy, Ruben Thompson, right?
00:06:30.319 --> 00:06:33.279
21-year-old from Cotaslo, outside of Perth.
00:06:33.360 --> 00:06:35.519
It's a it's a well-to-do suburb in Perth.
00:06:35.600 --> 00:06:40.720
Um, he is South African, so all that intel about the South African part is true.
00:06:41.120 --> 00:06:43.120
And you know, like this is what happens.
00:06:43.199 --> 00:06:45.360
You said it earlier, f around and find out, right?
00:06:45.439 --> 00:06:50.480
Like, they they prodigious posting on Twitter and Telegram and all kinds of other places.
00:06:50.639 --> 00:07:05.279
Didn't terrible reusing the same username and the same stupid password, like Krebs just like the Krebs article is just brutal and it's efficient.
00:07:06.720 --> 00:07:15.279
Oh my god, it's just like brutal and it's efficient tear down of how stupid these I can't say any cuss words, but I really want to say that dip word.
00:07:15.439 --> 00:07:18.319
Um, they just uh it's just morons, right?
00:07:18.800 --> 00:07:30.480
And I think it's hard for us to reconcile the fact that they are so stupid and made so many mistakes with the fact that their attacks in March and April and May were pretty complicated.
00:07:30.639 --> 00:07:45.199
I mean, and yes, they were barring heavily on the original Shy Halud threat actors and you know, barring from the ecosystem, but you know, it was effective because you know it was it it attacked a place where not a lot of people really kind of understood what was kind of happening.
00:07:45.279 --> 00:07:50.000
And we talk about that in that the interview that we did with with Akido and Socket and all those guys.
00:07:50.160 --> 00:07:54.560
The fact is that we all many of us use GitHub actions every day, or the equivalent, just to be clear.
00:07:55.439 --> 00:07:58.399
And there's just a lot going on there that we don't really kind of talk about.
00:07:58.480 --> 00:08:00.079
There's just a lot of containers and stuff going on.
00:08:00.160 --> 00:08:02.160
Then they took a they took advantage of that, right?
00:08:02.240 --> 00:08:03.439
And they were very effective.
00:08:03.680 --> 00:08:05.759
They don't they weren't able to actually make any money.
00:08:05.920 --> 00:08:08.319
My understanding is they made about$90,000.
00:08:08.879 --> 00:08:15.040
Like it just well, the the Krebs article says that Thompson made like 20k.
00:08:15.920 --> 00:08:17.759
So yeah, yeah.
00:08:18.079 --> 00:08:20.720
I mean, not sophisticated.
00:08:20.800 --> 00:08:34.480
Uh, I think this is a great example of how an LLM can get an unsophisticated bad actor further along than they would have been, but it can't make them.
00:08:35.120 --> 00:08:40.000
I mean, let's go back to our uh terminology from North Korea.
00:08:40.159 --> 00:08:44.320
You know, it doesn't build a go-to-market for them, it doesn't build a business for them.
00:08:44.559 --> 00:08:51.759
You know, they you have to know uh how to do targeting and how to take advantage of the data that you get a hold of.
00:08:51.840 --> 00:08:59.840
And so the good news out of this is they're not, you know, terribly smart about what they did collect.
00:09:00.000 --> 00:09:03.600
Um, let's just hope this is the last we've seen of this.
00:09:04.240 --> 00:09:06.399
Well, yeah, and let's talk about that for a second.
00:09:06.559 --> 00:09:10.559
Um, my understanding is that there's a lot more to come.
00:09:11.120 --> 00:09:15.279
Now, and and uh that when so what does that mean?
00:09:15.600 --> 00:09:24.720
You mean around the um not coming, but more more people getting in trouble or out in law enforcement activity.
00:09:24.799 --> 00:09:32.399
And here's the thing is that uh, you know, aside from exploiters who still is in the wind, um team PCP has been wrapped up.
00:09:32.480 --> 00:09:34.639
So, what is there more to do about that, right?
00:09:34.799 --> 00:09:41.919
Like I called it, you know, this basically I was saying team PCP was like one guy, maybe a second helper, and that's exactly what we have here.
00:09:42.159 --> 00:09:45.279
Um, you know, are there some other people ancillary around them?
00:09:45.360 --> 00:09:45.840
Of course, yeah.
00:09:45.919 --> 00:09:51.039
Like in Colonel Stub right now is out there just you know talking about how they turned themselves in and all this other shizzle.
00:09:51.120 --> 00:09:53.519
But um, the reality is it was relatively small.
00:09:54.799 --> 00:10:03.759
Yeah, oh my god, so many people like being oh, I was in the know, and oh just god, some of the most toxic personas on Twitter, but um, which is the right place to be toxic.
00:10:04.000 --> 00:10:14.559
Um, but the point I'm driving at it here is is an important one, which is if there's more to come, and team PCP has effectively been wrapped up with a few threads hanging out there.
00:10:14.879 --> 00:10:16.720
What are we what what's coming?
00:10:16.960 --> 00:10:31.600
And my expectation is that there is going to be movement against lapses and shiny hunters and some of these other groups because there's enough overlap between some of these groups where um, and I I I want to hope meet Francois.
00:10:31.679 --> 00:10:33.360
You know, I'm I'm talking about you, buddy.
00:10:33.519 --> 00:10:52.399
I'm hoping that something that what France Francois and I worked on um ends up um doing some good out there, but um uh you know, I think the reality is that um there are gonna be more arrests, there are gonna be another cruise, and um there's gonna be kind of this domino effect.
00:10:52.559 --> 00:11:06.000
Sorry to use these cliche terms, but there's gonna be a domino effect here where like once you get that much data from somebody because they've already pulled like I heard in one of the things a hundred terabytes already off of old mate Rubin's machine.
00:11:06.320 --> 00:11:12.399
Um, and you know, as everybody knows, they stole uh just a ton, absolute ton of credentials.
00:11:12.639 --> 00:11:15.600
So, you know, just a lot of there's a lot of gold there.
00:11:15.679 --> 00:11:20.639
And based on the rest of their opsec, I'm gonna guess that all this data was just sitting on their hard choice.
00:11:22.320 --> 00:11:26.480
The AFP now has uh and big shout out, by the way, to AFP.
00:11:26.960 --> 00:11:36.320
Um, not that they get back to people when they turn anyhow, but um the that aside, uh big shout out to AFP for working with FBI to to do this takedown.
00:11:36.399 --> 00:11:37.600
Um, so good on them.
00:11:37.840 --> 00:11:39.279
Yeah, good news today.
00:11:39.440 --> 00:11:40.559
Okay, let's talk about it.
00:11:40.639 --> 00:11:41.679
Today's a good day, Jen.
00:11:41.840 --> 00:11:42.559
Today's a good day.
00:11:43.360 --> 00:11:44.159
Today's a good day.
00:11:44.399 --> 00:11:50.399
We you and I have been talking about this day, like we literally have been talking about this happening for a while now.
00:11:50.559 --> 00:11:55.440
Like we knew it was happening, we just were waiting for the vaccinations to go through, and and here we are.
00:11:55.519 --> 00:11:56.000
It's happened.
00:11:56.080 --> 00:11:58.879
Team PCP is is effectively been taken down.
00:11:58.960 --> 00:11:59.519
That's awesome.
00:11:59.759 --> 00:12:01.600
Yeah, very happy about it.
00:12:01.840 --> 00:12:06.799
Um now let's talk about our favorite subject.
00:12:07.039 --> 00:12:14.480
Uh and I only say that because I think we do talk about this just about every podcast, but that's because we're always finding new things.
00:12:14.559 --> 00:12:17.039
So, this is what's going on with Paul and Writer.
00:12:17.279 --> 00:12:23.679
Um, we are preparing to do a talk in what, a week, week and a half.
00:12:23.919 --> 00:12:31.519
Um, and so we've been preparing for that and doing some extra hunts and found some interesting new things.
00:12:31.679 --> 00:12:40.080
Uh, some of it is more like reinforcing that it is bigger than what the data was initially showing.
00:12:40.240 --> 00:12:45.200
Some of it is showing it went back further than what the data initially showed.
00:12:45.360 --> 00:13:04.159
Um, we published a blog, I'll share the um link in the comments that uh goes through a pretty interesting case study of a person who got uh, I won't even say reinfected because they never cleaned out the infection to begin with.
00:13:04.799 --> 00:13:11.200
But they got infected, they thought they cleared it out, uh, it has been pushed into their packages.
00:13:11.360 --> 00:13:17.679
So um maybe maybe let's start there and then you can open up into the broader hunt that you've been doing.
00:13:18.000 --> 00:13:24.240
Yeah, I mean, at the heart of this is the fact that you just have a lot of developers um that have been compromised over the last couple of years.
00:13:24.399 --> 00:13:28.080
Contagious interview from DPRK has been going on since 2023.
00:13:28.240 --> 00:13:29.440
A lot of people are compromised.
00:13:29.759 --> 00:13:38.879
The problem is that what we didn't really kind of talk about as much as we probably should have is the fact that the DPRK maintained persistence on these developers' machines.
00:13:39.039 --> 00:13:46.639
Um and that is rearing its head now as all these compromised GitHub users, they're compromised on their local machines.
00:13:46.720 --> 00:13:51.759
Their GitHub accounts aren't necessarily um uh compromised, but they're compromised on their local machines.
00:13:51.840 --> 00:13:54.159
So the persistence is happening on their local machine.
00:13:54.480 --> 00:13:59.200
And uh what we're seeing now, we we talked about this a couple episodes ago with with Go.
00:13:59.279 --> 00:14:09.200
We every day we see a new smattering of Pollenwriter in Go packages because Go doesn't have an additional publish step like NPM or PyPy does.
00:14:09.360 --> 00:14:17.120
But we are now seeing Pollenwriter in PyPy, we're seeing it in NPM, we're seeing it in VS Code, we're seeing it in other places.
00:14:17.440 --> 00:14:27.919
As these developers you know go about their daily business and they go to deploy a new npm package or new PyPy package or whatever, the Pollenwriter malware slides through and inside of that new thing.
00:14:28.080 --> 00:14:36.960
So in this particular case, the fetch page assets and HTML to Gutenberg maintainer, um Diogo was compromised.
00:14:37.039 --> 00:14:48.000
And you know, npm took down version whatever dot nine of of um fetch page assets, but then immediately he published dot 10.11.12.13.
00:14:48.080 --> 00:14:54.879
These are all legitimate pushes by the real um, or actually, in those cases, Jen, I think that might have been DPR.
00:14:55.279 --> 00:14:57.200
No, they're all well, okay.
00:14:57.279 --> 00:14:58.480
Let's rewind a little bit.
00:14:58.799 --> 00:15:04.000
So Diogo is a legitimate developer who got compromised.
00:15:04.240 --> 00:15:15.200
Uh, we don't know specifically how he did, but probably given his um profile of like an independent developer, is probably through Contagious Interview.
00:15:15.360 --> 00:15:21.519
Um, it looks like it happened maybe around January of this year.
00:15:21.840 --> 00:15:37.279
And um the way that this particular piece of malware works is yeah, it's on your machine, but then it looks for places that it can inject its payload and then pushes them to your repos.
00:15:37.360 --> 00:15:46.000
And so that's what happened is through his normal CI processes, uh infected files were pushed into all of his repos.
00:15:46.320 --> 00:15:59.919
And then because two of those repos serve um as source code for two corresponding NPM projects, when he pushed updates to those npm projects, new versions, the malware came along for the ride.
00:16:00.240 --> 00:16:04.000
And uh that malware was discovered a few months ago.
00:16:04.240 --> 00:16:07.840
It got taken down relatively quickly.
00:16:08.159 --> 00:16:11.440
Um he went through some remediation steps.
00:16:11.600 --> 00:16:19.200
We can see evidence of that where he deleted the files that had the payloads in it, but he only did a partial job.
00:16:19.279 --> 00:16:24.639
He didn't delete the VS Code task.json files that were triggering those payloads.
00:16:24.799 --> 00:16:35.279
And we can assume he also uh didn't properly probably clean his machine and we can look through his repos and we can still see evidence of infection in his repos.
00:16:35.679 --> 00:16:41.600
And whether he continued to push new versions or the threat actor, I would say it's probably him.
00:16:41.840 --> 00:16:45.600
He probably, you know, was making updates to his packages.
00:16:45.840 --> 00:16:55.360
We can see this series of you know updates coming out over the last couple of months where he pushed a new version because he wanted to, you know, have a non-malicious version.
00:16:55.600 --> 00:17:03.840
And then the threat actor was able to push a new uh payload onto his machine.
00:17:04.559 --> 00:17:12.240
And that is through the the wrap that is undoubtedly on his machine, which then trickled its way back into his packages.
00:17:12.400 --> 00:17:18.720
And so May, I think, is when those original poisoned packages were published.
00:17:18.880 --> 00:17:21.359
They've each had a few versions come out since.
00:17:21.519 --> 00:17:23.519
They are all malicious.
00:17:24.240 --> 00:17:31.359
Uh and I think the thing that surprised us was that nobody has caught this.
00:17:31.519 --> 00:17:35.200
These this was a known compromised developer.
00:17:36.000 --> 00:17:39.680
Uh two known compromised packages.
00:17:40.240 --> 00:17:54.160
Not only did we not catch it, um, you know, we'll own our own thing here, NPM didn't catch it, which certainly I would have hoped that they would have, since he should already be on their radar.
00:17:54.240 --> 00:18:01.680
But as you talk about in your blog, they're focused on the package as the important data point, not the individual.
00:18:01.920 --> 00:18:05.119
None of the other scanners seem to have picked it up either.
00:18:05.279 --> 00:18:11.039
So he has had this persistent infection for several months that has had evolved payloads.
00:18:11.200 --> 00:18:13.599
So no fun for him.
00:18:13.920 --> 00:18:30.799
Yeah, I and I think the timeline is important because each victim is a little bit different because what happens is the infection starts on your local machine via um a malicious git repo that gets the payload gets run from VS, typically from VS Code using the task function.
00:18:30.960 --> 00:18:32.559
Sometimes there's other alternative ways.
00:18:32.640 --> 00:18:39.200
There's sometimes there's a git hook, and other times you you run the app, and when you run the app, it actually runs some system commands.
00:18:39.359 --> 00:18:41.359
There's a number of ways, but most of the time it's VS Codes.
00:18:41.519 --> 00:18:43.680
So you're compromised on your machine.
00:18:43.839 --> 00:18:59.440
And then what happens is that allows North Korean threat actors to manipulate files on your machine, they have access to your disk, and what they do is they go and look for all the git repos that you've got, which you said earlier, and they find ones that match what they need, and then they push these payloads in.
00:18:59.599 --> 00:19:02.880
Now, the second part, this is where things sometimes change.
00:19:03.119 --> 00:19:18.480
If they have if North Korea has access to your credentials, because when the info stealer that was part of that rat and part of that kill chain, when the info stealer runs, if they get access to your Git um account via a pat or some other function, then what they do is they will then push.
00:19:18.559 --> 00:19:25.200
And so in Diago's case, there were pushes that our system identifies as non-human.
00:19:25.279 --> 00:19:32.559
So basically, what happened is DPRK orchestrated changes on his local disk to files that were inside of the Git repo.
00:19:32.640 --> 00:19:39.519
It then also orchestrated the push of those out, you know, basically overwrite a commit and then push it out to GitHub.
00:19:39.599 --> 00:19:41.839
So those two things both were automated by DPRK.
00:19:42.160 --> 00:19:47.359
The third thing, which was not automated, which is the publish of the npm package.
00:19:47.519 --> 00:19:52.160
Those were always Diogo himself doing those as part of legitimate work.
00:19:52.319 --> 00:20:00.960
He just didn't realize that his GitHub read repo that was building the NPM package had this, you know, persistent payload sitting on top of it.
00:20:01.200 --> 00:20:05.839
And DPRK pushed three additional payloads into the Git repos.
00:20:06.079 --> 00:20:08.400
So the last one wasn't that long ago, it was just a few days.
00:20:08.480 --> 00:20:15.119
Well, about a week ago now, but and that last one is null receiver, it's the latest version, it's got a brand new campaign marker.
00:20:15.359 --> 00:20:16.240
It's the best.
00:20:16.319 --> 00:20:24.160
And that's the problem with this is that when DPRK has access to your machine and can and has a rat running there, they can keep pushing new better payloads.
00:20:24.400 --> 00:20:26.960
I mean they're helping you out, they're giving you updates, right?
00:20:27.759 --> 00:20:29.200
They're giving you the wrong updates.
00:20:29.839 --> 00:20:30.559
Wrong updates.
00:20:32.000 --> 00:20:34.480
You want to pin their old version of their old malware.
00:20:35.519 --> 00:20:46.559
We've been mapping uh their persistence mechanisms, and there's at least four separate persistence mechanisms related to this campaign.
00:20:46.640 --> 00:21:07.119
Some of it's in the original kill chain, some of it's Pollenwriter specific, but there is a new one um that somebody in the community surfaced maybe a week or two ago, where they have now added a step in their kill chain where they overwrite the npm CLI with a malicious version of the CLI.
00:21:07.759 --> 00:21:09.680
That's a particularly nasty one.
00:21:09.839 --> 00:21:25.920
So even if you clear off everything else that we've been talking about for months, this little malicious npm CLI, the next time you fire up npm, we'll say reinstall malware, and it just kicks off the whole thing again.
00:21:26.240 --> 00:21:49.920
If you if you find the the Python or the JavaScript persistence, the rat and you kill that and you find where it's starting from, from a bash RC file or an NPM RC file or wherever it is, if you kill that, if you get it out of there, if you know if you go and look and find all the payloads and all your git repos and get rid of those and actually remove them from your git index, because just pushing a new version of it doesn't mean that the payload's gone.
00:21:50.000 --> 00:21:52.160
It just means you've got a new version that doesn't have the payload.
00:21:52.319 --> 00:21:59.839
If you do all those things alone, but you don't uninstall or delete npm, you're gonna get reinfected because the next time you run npm.
00:22:00.160 --> 00:22:00.640
NPM.
00:22:00.799 --> 00:22:15.279
It's so basically the normal size of NPM, which by the way is just a NPM CLI is just basically a bunch of like um simlinks to different JavaScript files, most of which end up in a uh in a CLI folder inside the NPM.
00:22:15.359 --> 00:22:16.160
Anyhow, it's crazy.
00:22:16.319 --> 00:22:16.960
Why would you do that?
00:22:17.039 --> 00:22:18.240
But it's JavaScript.
00:22:18.400 --> 00:22:23.680
Um, they overwrite that 200-byte file with a file that ends up being something like a thousand K or something.
00:22:23.759 --> 00:22:24.640
Yeah, I think it's big as well.
00:22:24.720 --> 00:22:26.880
I think it's I think it's 1100K or something like that.
00:22:27.119 --> 00:22:30.480
Um, but it's and and some people, you know, we didn't even do this.
00:22:30.559 --> 00:22:35.759
Some people out there in the open in the wild have created tests um for some of this stuff.
00:22:35.839 --> 00:22:40.240
So and and we've pulled that into our blog and also shout it out to them too as well.
00:22:40.319 --> 00:22:45.920
So there's some really simple things you can do to look at the size of your npm file, for example.
00:22:46.079 --> 00:22:48.240
Um, just make sure you're following the simlinks.
00:22:48.319 --> 00:22:50.400
So if not, then not gonna work.
00:22:50.640 --> 00:23:01.200
Yeah, the other thing that you said you've been observing is um so there's two kinds of files that this malware will create on your machine or modify on your machine.
00:23:01.279 --> 00:23:04.400
We've talked extensively about the task.json files.
00:23:05.119 --> 00:23:13.839
We are still seeing um lots of ones that are config files, JavaScript or TypeScript config files.
00:23:14.079 --> 00:23:27.519
And Paul, you said that initially they tended to save those in index, but now you are seeing them all over the place that they're just spread and it's not, you know, three or four different types of files.
00:23:27.599 --> 00:23:29.839
It's really just any kind of config.
00:23:30.079 --> 00:23:32.720
Talk a little bit more about what you've been observing.
00:23:33.039 --> 00:23:34.240
Yeah, good call out.
00:23:34.400 --> 00:23:59.200
Um, so in the original version of Pawn Rider from from March of 2026, um, basically what happens is in that in that part of the kill chain where their malware is going and looking for JavaScript files to write into, it was only looking for five or six files wite.config.js and and you know babel.config.json and just a very small number.
00:23:59.279 --> 00:24:04.799
And then that number grew over the next couple of months, and you know, they were looking for like 15 or 16 different files.
00:24:04.880 --> 00:24:07.759
And if they find that, they would just append their payload on the end of it.
00:24:07.920 --> 00:24:11.759
Well now they're just looking for any JavaScript file.
00:24:12.079 --> 00:24:21.599
Any and what what they're also doing, Jen, is they is they're looking for files that are actually getting used as part of the execution order for that particular project.
00:24:21.680 --> 00:24:26.319
So that's what's smart about it, is that they don't just go and find some like random JavaScript file.
00:24:26.400 --> 00:24:36.240
They basically look at the code and really briefly take a look at kind of how that how the call um process works, and then they find a JavaScript file that's actually gonna get called and they drop it into there.
00:24:36.319 --> 00:24:38.160
So reachability.
00:24:38.400 --> 00:24:39.039
Yeah, exactly.
00:24:39.119 --> 00:24:40.160
It was really, really well.
00:24:40.240 --> 00:24:44.240
I it's very simplistic reach of reachability.
00:24:44.559 --> 00:24:46.240
But that's funny.
00:24:46.559 --> 00:24:50.799
Um but uh so we're seeing it now in all kinds of stuff.
00:24:50.880 --> 00:24:59.519
So basically, this is one of the things, this is why our hunt keeps growing is that you know we had that original five or six files they were looking for, then we had like the 10 or 8 or whatever, and then it was grew and grew.
00:24:59.599 --> 00:25:05.599
And now we just look for any types, types, any here's the extensions you want to look for.js, obvious.
00:25:05.759 --> 00:25:09.920
Um, excuse me, dot TS TypeScript also probably should be uh obvious.
00:25:10.079 --> 00:25:19.920
Then all the minified in the the the um uh the ESM and common uh JS files, CJS, mjs, and that whole kind of thing.
00:25:20.160 --> 00:25:26.559
So there's like five or six extensions you want to look for, um, which means that your searching now is gonna be you know longer.
00:25:26.640 --> 00:25:30.960
It's gonna be more, it's gonna take more time because you're looking through a lot more files, but you know, that's what you got to do.
00:25:31.039 --> 00:25:35.200
And when we're doing that now in GitHub out there forward hunting, we're just finding a lot more files.
00:25:35.359 --> 00:25:41.920
I pushed like, I don't know, 1200 or 1400 new GitHub repos to OSM just yesterday, one day.
00:25:42.559 --> 00:25:50.160
Um, you said something that gives me an opportunity to get up on my soapbox, and I know you're gonna join me up on it.
00:25:50.400 --> 00:26:06.960
Um, because this takes so much time, uh, this is not just about like cleaning your own stuff and worrying about yourself for every minute, hour, day that you're going through incident response.
00:26:07.119 --> 00:26:14.480
If you have public repos, if you're collaborating with anyone, uh the infection is spreading to your network.
00:26:14.720 --> 00:26:17.920
And I know that disclosures suck.
00:26:18.400 --> 00:26:20.160
Nobody likes to do that.
00:26:20.480 --> 00:26:26.400
But if you found that you've been infected, uh, please, please, you know, disclose.
00:26:26.559 --> 00:26:41.759
Tell people in your network that you know are collaborating, not just because it's the right thing to do for the community, but if you clean out all signs of infection and then you're still collaborating with people who are infected, you're just gonna get reinfected.
00:26:41.839 --> 00:26:49.759
So if you don't give them the opportunity to look for signs of compromise and address it, you're hurting yourself in addition to them.
00:26:50.240 --> 00:26:52.559
100, oh my god, great call out.
00:26:52.880 --> 00:26:55.359
Um, and we are see we are genuinely seeing that.
00:26:55.519 --> 00:27:04.480
So people they they say, oh, some, you know, like for example, I'm automating disclosures now into open source projects that we find Pollen Rider in.
00:27:04.640 --> 00:27:10.480
Well, basically, we have an automation thing that goes out there and drops an issue into the GitHub issues for that particular project.
00:27:10.720 --> 00:27:15.599
What'll happen is they'll see that, then they'll remove it from the GitHub repo and they won't say anything.
00:27:15.759 --> 00:27:18.079
They'll close the issue and they won't say anything, right?
00:27:18.240 --> 00:27:26.000
But then the problem is that somebody inside one of their contributors and maintainers, or sometimes multiple, uh, will still be infected on their laptops and the whole thing will just come back.
00:27:26.079 --> 00:27:33.519
And we've now seen that with some of these open source projects where it started out as one or two people inside of the contributor group had it, and now they're all infected.
00:27:33.599 --> 00:27:38.480
It's like COVID, except you can't build up an immunity, you can just get it immediately again, right?
00:27:38.640 --> 00:27:45.279
So um, to your point, I think we need to do a lot better at just saying, hey, listen, I got hacked.
00:27:45.440 --> 00:27:48.640
Um, and here's what you know, here's what we did.
00:27:48.799 --> 00:27:56.559
We suggest you do the same thing, and here's the things to look for, and reference our that great um blog post that you put together, Colin Rider for for developers.
00:27:56.799 --> 00:27:57.440
Yeah, thank you.
00:27:57.519 --> 00:27:59.200
I'll drop that link in the chat.
00:27:59.359 --> 00:28:03.839
I put together a little incident response remediation guide.
00:28:04.559 --> 00:28:08.480
Um you know, this conversation.
00:28:08.720 --> 00:28:13.440
Um, hold on, I can type and talk at the same time, I swear.
00:28:14.720 --> 00:28:23.279
Um this reminds me of you know, the whole there's two kinds of companies, those that have been compromised and those that don't know they've been compromised.
00:28:23.519 --> 00:28:27.680
I think we're you know, this is this is a similar thing.
00:28:27.839 --> 00:28:33.440
Um, this is spreading widely, it's evolving rapidly.
00:28:33.920 --> 00:28:38.400
Um the signals are constantly changing.
00:28:38.559 --> 00:28:51.599
You know, we're constantly updating our own internal detections because what was reliable weeks or months ago is no longer being used or not being used as widespread.
00:28:51.759 --> 00:29:04.240
Um, so yeah, I guess this is a plug for having some intel on PollenWriter so you know what to look for, but start with the blog that I wrote because it'll at least give you some places to look for.
00:29:06.720 --> 00:29:08.160
Excellent, excellent advice.
00:29:08.400 --> 00:29:09.279
I have nothing to add.
00:29:09.519 --> 00:29:09.920
Nothing to do with that.
00:29:12.720 --> 00:29:14.799
Okay, let's wrap it there.
00:29:14.960 --> 00:29:22.160
Um as a heads up to our dedicated listeners, of which there are some, which we love.
00:29:22.559 --> 00:29:32.640
Um, we are gonna take a break next week for a little much needed uh vacation time slash family time on each side.
00:29:32.799 --> 00:29:41.279
And then we're gonna figure out when, how, where to record an episode while we are in Strasbourg.
00:29:41.759 --> 00:29:47.039
Um coming up uh in the first week of, or I guess second week of September.
00:29:47.119 --> 00:29:57.119
So very much looking forward to another uh live from the conference, Jen and Paul talking about what we've uh been experiencing, learning, etc.
00:29:57.599 --> 00:29:59.279
And hopefully I'm not sick this time.
00:29:59.599 --> 00:30:02.000
You're not gonna be sick this time, you're gonna be so healthy.
00:30:02.319 --> 00:30:04.960
Um my my immune system's all jacked up now.
00:30:05.119 --> 00:30:10.880
Um yeah, just to kind of double click on that, we will be in Europe uh September 6th to 11.
00:30:11.039 --> 00:30:14.079
Um uh seven to 10.
00:30:15.440 --> 00:30:18.960
Um, yeah.
00:30:19.119 --> 00:30:21.119
Oh, sorry, the conference is the seventh.
00:30:21.359 --> 00:30:24.559
Yeah, I'm also gonna be yeah, I'm gonna be there September 11th too as well.
00:30:24.720 --> 00:30:32.640
I'm actually talking at uh I'm actually sorry, I'm giving training on GitHub CTI stuff at uh Frankfurt B size on the 11th.
00:30:32.720 --> 00:30:36.000
I'm having dinner with some friends the night before, so I'm really looking forward to this.
00:30:36.160 --> 00:30:41.599
Um, so yeah, if you're gonna be in Frankfurt or Strasbourg um for whatever reason, let us know.
00:30:42.400 --> 00:30:48.559
We have a lot of users in Europe, so we have a disproportionate number of OSM users in Europe.
00:30:48.720 --> 00:30:50.400
So come out and say hi.
00:30:51.119 --> 00:30:52.880
On that note, have a good one.
00:30:53.119 --> 00:30:54.000
Yeah, thanks for listening.
00:30:54.079 --> 00:30:55.119
We really really appreciate it.
00:00:00.959 --> 00:00:13.359
It is Thursday, August 27th, and we are here with I'm going to call it breaking news out of Australia, which maybe is not a thing that we hear too often in the cybersecurity world.
00:00:13.679 --> 00:00:15.279
But uh good news.
00:00:15.679 --> 00:00:21.600
The Australian federal police arrested two individuals associated with Team PCP.
00:00:22.000 --> 00:00:27.839
Um they're two of the more uh perhaps active members, from what it sounds like.
00:00:27.920 --> 00:00:30.719
And Paul, love to hear your side of this in just a second.
00:00:30.879 --> 00:00:36.079
But just in brief, um, it's a 21-year-old and a 23-year-old.
00:00:36.240 --> 00:00:46.560
Uh Ruben Thompson and uh the other suspect was identified by ABC's court reporting to be Lewis uh Gabler.
00:00:47.359 --> 00:00:50.479
Uh you know what can I say?
00:00:50.640 --> 00:00:57.200
It on one hand, play stupid games, get stupid prizes, uh F around and find out.
00:00:57.520 --> 00:01:01.920
But also um these are two incredibly young people.
00:01:02.320 --> 00:01:08.400
Uh one of has a history of drug abuse and employment problems.
00:01:08.640 --> 00:01:13.519
The other has gotten involved in some pretty nasty neo-Nazi stuff.
00:01:13.920 --> 00:01:18.959
Uh honestly, as a parent, I hate to see two young men having gone down this path.
00:01:19.200 --> 00:01:28.159
I hope that whatever comes next for them uh gives them an opportunity to decide to do something different with their lives.
00:01:28.239 --> 00:01:30.879
They're young and they have a lot of life ahead of them, hopefully.
00:01:31.120 --> 00:01:33.120
And I hope they've learned from this.
00:01:34.239 --> 00:01:37.519
You are like you and I are just so different in this regard.
00:01:37.680 --> 00:01:39.519
Like we're both parents, right?
00:01:39.599 --> 00:01:46.400
And so I think that's an important thing to, but I am just so like I have no sympathy for them.
00:01:46.719 --> 00:01:47.599
They're drug addicts.
00:01:50.480 --> 00:01:52.640
What they did was incredibly wrong.
00:01:53.280 --> 00:01:56.319
But these are also like it's sad to see.
00:01:56.480 --> 00:02:01.760
This is not your like hardened criminal uh life of crime kind of thing.
00:02:01.840 --> 00:02:07.840
Like, these are, as we've been talking about for several months, a couple of like kind of dumb kids.
00:02:08.560 --> 00:02:14.560
Yeah, and I think that that's gonna be the theme running through today's show, which is just dumb kids.
00:02:14.719 --> 00:02:19.280
They just did a bunch of dumb stuff, which we knew uh we were calling out before they got arrested.
00:02:19.439 --> 00:02:36.879
But um, I think uh one take on that last part or that first part there before we move into the the heart of today's conversation about these guys, is that listen, I understand they're at the beginning of their lives, but they also come from what appear to be relatively well-off parents.
00:02:37.039 --> 00:02:41.599
They seem like mostly useless drifter type people.
00:02:41.759 --> 00:02:44.639
Like, listen, I was a I was a 20-year-old man, right?
00:02:44.719 --> 00:02:47.120
That was trying to figure out you know where I was.
00:02:47.199 --> 00:02:53.280
And you know what I did is I found I found a passion and I followed it and I became successful, right?
00:02:53.439 --> 00:02:55.759
So I don't have I don't, I don't no.
00:02:56.319 --> 00:03:25.360
Um maybe I'm giving well, no, I don't disagree with you because you know, I was reading uh Brian's Kreb, Brian Krebs article in detail, and I found Ruben Thompson's general attitude about the job industry to be on one hand, understandable because getting into cybersecurity is not easy, but on the other, he acted like he didn't see an alternative.
00:03:25.840 --> 00:03:29.120
And I just I have a tough time with that.
00:03:29.199 --> 00:03:38.800
You know, I know a lot of people who work hard to get into cybersecurity who have the same uh barriers that he may have had.
00:03:39.199 --> 00:03:45.919
Uh, you know, they talk in the article about, you know, if you don't have experience, employers won't look at you.
00:03:46.159 --> 00:03:49.039
There are a lot of ways to get experience.
00:03:49.840 --> 00:03:58.319
Well, you know, bad people like to latch on legitimate arguments like that to make to validate why they did what they did.
00:03:58.400 --> 00:04:09.439
And let me just start out by saying something super crazy, which is Jeffrey Dahmer, before he killed his first person, could you know it was just a 20-year-old man who hadn't done anything, right?
00:04:09.599 --> 00:04:12.639
And you know, the innate evil within him.
00:04:12.800 --> 00:04:15.439
And these two guys, I got I got no sympathy that well.
00:04:15.520 --> 00:04:19.920
I know you we neither one of us has sympathy for him, but I um I hope they throw the book at him.
00:04:20.079 --> 00:04:29.040
Um, not only do I hope they throw the book at him, um, these two young kids are just gonna, even in Australian prison, because both of them are white supremacists.
00:04:29.120 --> 00:04:38.720
That's the other thing you have like they both one of them, Casper, is more out there, but you look at some of the things that that old mate Ruben has said.
00:04:38.800 --> 00:04:54.639
He comes from South African, he comes from a he comes from a I don't think he comes from a Boer background, but I think he comes from an Anglo background in South Africa and is very um, you know, entrenched in that kind of white supremacist, Anglo-nationalistic.
00:04:54.800 --> 00:04:58.079
And yeah, they've said some pretty nasty things.
00:04:58.319 --> 00:05:05.040
It's there's a there's there's this growing movement, and I don't want to give it too much play here, but there's this growing movement called re migration, right?
00:05:05.120 --> 00:05:10.639
Which is just a fancy word for racist white supremacist nationalists, and there is some overlap.
00:05:10.959 --> 00:05:20.800
Um, last night a um a journalist was pinging me some stuff about some of the remigration things happening here, and there's a connection between that and some of these like South African folks.
00:05:20.959 --> 00:05:23.360
Um, anyhow, more to be discussed later on.
00:05:23.519 --> 00:05:25.120
Let's jump into the heart of this, Jen.
00:05:25.199 --> 00:05:25.920
Let's get her on.
00:05:26.160 --> 00:05:28.399
Well, so where do you want to start with it?
00:05:28.639 --> 00:05:37.360
Because uh there's plenty to discuss from the Krebs article, from the uh AFP uh press release.
00:05:37.600 --> 00:05:46.639
I know you have been uh talking to people behind the scenes for multiple months, I want to say.
00:05:46.800 --> 00:05:50.480
Uh, so you you know kind of knew this was coming.
00:05:50.879 --> 00:05:53.360
Um what do you want to discuss?
00:05:53.680 --> 00:05:57.600
Yeah, I mean, I like uh, you know, I was preview to some inside baseball.
00:05:57.759 --> 00:06:03.680
Um, you know, and I don't want to go into a lot of details because I don't want to, you know, I don't want to be part of inside baseball in the future.
00:06:04.000 --> 00:06:19.279
Yeah, you know, I want, but but the reality is that um I had some intel that you know one of these people was perhaps in my country, um, and um, you know, some meetings took place because of that.
00:06:19.439 --> 00:06:25.519
But um, I think the first thing I want to say start out by saying is that listen, we were right, we called it, right?
00:06:25.680 --> 00:06:30.160
Like basically, team PCB is one guy, Ruben Thompson, right?
00:06:30.319 --> 00:06:33.279
21-year-old from Cotaslo, outside of Perth.
00:06:33.360 --> 00:06:35.519
It's a it's a well-to-do suburb in Perth.
00:06:35.600 --> 00:06:40.720
Um, he is South African, so all that intel about the South African part is true.
00:06:41.120 --> 00:06:43.120
And you know, like this is what happens.
00:06:43.199 --> 00:06:45.360
You said it earlier, f around and find out, right?
00:06:45.439 --> 00:06:50.480
Like, they they prodigious posting on Twitter and Telegram and all kinds of other places.
00:06:50.639 --> 00:07:05.279
Didn't terrible reusing the same username and the same stupid password, like Krebs just like the Krebs article is just brutal and it's efficient.
00:07:06.720 --> 00:07:15.279
Oh my god, it's just like brutal and it's efficient tear down of how stupid these I can't say any cuss words, but I really want to say that dip word.
00:07:15.439 --> 00:07:18.319
Um, they just uh it's just morons, right?
00:07:18.800 --> 00:07:30.480
And I think it's hard for us to reconcile the fact that they are so stupid and made so many mistakes with the fact that their attacks in March and April and May were pretty complicated.
00:07:30.639 --> 00:07:45.199
I mean, and yes, they were barring heavily on the original Shy Halud threat actors and you know, barring from the ecosystem, but you know, it was effective because you know it was it it attacked a place where not a lot of people really kind of understood what was kind of happening.
00:07:45.279 --> 00:07:50.000
And we talk about that in that the interview that we did with with Akido and Socket and all those guys.
00:07:50.160 --> 00:07:54.560
The fact is that we all many of us use GitHub actions every day, or the equivalent, just to be clear.
00:07:55.439 --> 00:07:58.399
And there's just a lot going on there that we don't really kind of talk about.
00:07:58.480 --> 00:08:00.079
There's just a lot of containers and stuff going on.
00:08:00.160 --> 00:08:02.160
Then they took a they took advantage of that, right?
00:08:02.240 --> 00:08:03.439
And they were very effective.
00:08:03.680 --> 00:08:05.759
They don't they weren't able to actually make any money.
00:08:05.920 --> 00:08:08.319
My understanding is they made about$90,000.
00:08:08.879 --> 00:08:15.040
Like it just well, the the Krebs article says that Thompson made like 20k.
00:08:15.920 --> 00:08:17.759
So yeah, yeah.
00:08:18.079 --> 00:08:20.720
I mean, not sophisticated.
00:08:20.800 --> 00:08:34.480
Uh, I think this is a great example of how an LLM can get an unsophisticated bad actor further along than they would have been, but it can't make them.
00:08:35.120 --> 00:08:40.000
I mean, let's go back to our uh terminology from North Korea.
00:08:40.159 --> 00:08:44.320
You know, it doesn't build a go-to-market for them, it doesn't build a business for them.
00:08:44.559 --> 00:08:51.759
You know, they you have to know uh how to do targeting and how to take advantage of the data that you get a hold of.
00:08:51.840 --> 00:08:59.840
And so the good news out of this is they're not, you know, terribly smart about what they did collect.
00:09:00.000 --> 00:09:03.600
Um, let's just hope this is the last we've seen of this.
00:09:04.240 --> 00:09:06.399
Well, yeah, and let's talk about that for a second.
00:09:06.559 --> 00:09:10.559
Um, my understanding is that there's a lot more to come.
00:09:11.120 --> 00:09:15.279
Now, and and uh that when so what does that mean?
00:09:15.600 --> 00:09:24.720
You mean around the um not coming, but more more people getting in trouble or out in law enforcement activity.
00:09:24.799 --> 00:09:32.399
And here's the thing is that uh, you know, aside from exploiters who still is in the wind, um team PCP has been wrapped up.
00:09:32.480 --> 00:09:34.639
So, what is there more to do about that, right?
00:09:34.799 --> 00:09:41.919
Like I called it, you know, this basically I was saying team PCP was like one guy, maybe a second helper, and that's exactly what we have here.
00:09:42.159 --> 00:09:45.279
Um, you know, are there some other people ancillary around them?
00:09:45.360 --> 00:09:45.840
Of course, yeah.
00:09:45.919 --> 00:09:51.039
Like in Colonel Stub right now is out there just you know talking about how they turned themselves in and all this other shizzle.
00:09:51.120 --> 00:09:53.519
But um, the reality is it was relatively small.
00:09:54.799 --> 00:10:03.759
Yeah, oh my god, so many people like being oh, I was in the know, and oh just god, some of the most toxic personas on Twitter, but um, which is the right place to be toxic.
00:10:04.000 --> 00:10:14.559
Um, but the point I'm driving at it here is is an important one, which is if there's more to come, and team PCP has effectively been wrapped up with a few threads hanging out there.
00:10:14.879 --> 00:10:16.720
What are we what what's coming?
00:10:16.960 --> 00:10:31.600
And my expectation is that there is going to be movement against lapses and shiny hunters and some of these other groups because there's enough overlap between some of these groups where um, and I I I want to hope meet Francois.
00:10:31.679 --> 00:10:33.360
You know, I'm I'm talking about you, buddy.
00:10:33.519 --> 00:10:52.399
I'm hoping that something that what France Francois and I worked on um ends up um doing some good out there, but um uh you know, I think the reality is that um there are gonna be more arrests, there are gonna be another cruise, and um there's gonna be kind of this domino effect.
00:10:52.559 --> 00:11:06.000
Sorry to use these cliche terms, but there's gonna be a domino effect here where like once you get that much data from somebody because they've already pulled like I heard in one of the things a hundred terabytes already off of old mate Rubin's machine.
00:11:06.320 --> 00:11:12.399
Um, and you know, as everybody knows, they stole uh just a ton, absolute ton of credentials.
00:11:12.639 --> 00:11:15.600
So, you know, just a lot of there's a lot of gold there.
00:11:15.679 --> 00:11:20.639
And based on the rest of their opsec, I'm gonna guess that all this data was just sitting on their hard choice.
00:11:22.320 --> 00:11:26.480
The AFP now has uh and big shout out, by the way, to AFP.
00:11:26.960 --> 00:11:36.320
Um, not that they get back to people when they turn anyhow, but um the that aside, uh big shout out to AFP for working with FBI to to do this takedown.
00:11:36.399 --> 00:11:37.600
Um, so good on them.
00:11:37.840 --> 00:11:39.279
Yeah, good news today.
00:11:39.440 --> 00:11:40.559
Okay, let's talk about it.
00:11:40.639 --> 00:11:41.679
Today's a good day, Jen.
00:11:41.840 --> 00:11:42.559
Today's a good day.
00:11:43.360 --> 00:11:44.159
Today's a good day.
00:11:44.399 --> 00:11:50.399
We you and I have been talking about this day, like we literally have been talking about this happening for a while now.
00:11:50.559 --> 00:11:55.440
Like we knew it was happening, we just were waiting for the vaccinations to go through, and and here we are.
00:11:55.519 --> 00:11:56.000
It's happened.
00:11:56.080 --> 00:11:58.879
Team PCP is is effectively been taken down.
00:11:58.960 --> 00:11:59.519
That's awesome.
00:11:59.759 --> 00:12:01.600
Yeah, very happy about it.
00:12:01.840 --> 00:12:06.799
Um now let's talk about our favorite subject.
00:12:07.039 --> 00:12:14.480
Uh and I only say that because I think we do talk about this just about every podcast, but that's because we're always finding new things.
00:12:14.559 --> 00:12:17.039
So, this is what's going on with Paul and Writer.
00:12:17.279 --> 00:12:23.679
Um, we are preparing to do a talk in what, a week, week and a half.
00:12:23.919 --> 00:12:31.519
Um, and so we've been preparing for that and doing some extra hunts and found some interesting new things.
00:12:31.679 --> 00:12:40.080
Uh, some of it is more like reinforcing that it is bigger than what the data was initially showing.
00:12:40.240 --> 00:12:45.200
Some of it is showing it went back further than what the data initially showed.
00:12:45.360 --> 00:13:04.159
Um, we published a blog, I'll share the um link in the comments that uh goes through a pretty interesting case study of a person who got uh, I won't even say reinfected because they never cleaned out the infection to begin with.
00:13:04.799 --> 00:13:11.200
But they got infected, they thought they cleared it out, uh, it has been pushed into their packages.
00:13:11.360 --> 00:13:17.679
So um maybe maybe let's start there and then you can open up into the broader hunt that you've been doing.
00:13:18.000 --> 00:13:24.240
Yeah, I mean, at the heart of this is the fact that you just have a lot of developers um that have been compromised over the last couple of years.
00:13:24.399 --> 00:13:28.080
Contagious interview from DPRK has been going on since 2023.
00:13:28.240 --> 00:13:29.440
A lot of people are compromised.
00:13:29.759 --> 00:13:38.879
The problem is that what we didn't really kind of talk about as much as we probably should have is the fact that the DPRK maintained persistence on these developers' machines.
00:13:39.039 --> 00:13:46.639
Um and that is rearing its head now as all these compromised GitHub users, they're compromised on their local machines.
00:13:46.720 --> 00:13:51.759
Their GitHub accounts aren't necessarily um uh compromised, but they're compromised on their local machines.
00:13:51.840 --> 00:13:54.159
So the persistence is happening on their local machine.
00:13:54.480 --> 00:13:59.200
And uh what we're seeing now, we we talked about this a couple episodes ago with with Go.
00:13:59.279 --> 00:14:09.200
We every day we see a new smattering of Pollenwriter in Go packages because Go doesn't have an additional publish step like NPM or PyPy does.
00:14:09.360 --> 00:14:17.120
But we are now seeing Pollenwriter in PyPy, we're seeing it in NPM, we're seeing it in VS Code, we're seeing it in other places.
00:14:17.440 --> 00:14:27.919
As these developers you know go about their daily business and they go to deploy a new npm package or new PyPy package or whatever, the Pollenwriter malware slides through and inside of that new thing.
00:14:28.080 --> 00:14:36.960
So in this particular case, the fetch page assets and HTML to Gutenberg maintainer, um Diogo was compromised.
00:14:37.039 --> 00:14:48.000
And you know, npm took down version whatever dot nine of of um fetch page assets, but then immediately he published dot 10.11.12.13.
00:14:48.080 --> 00:14:54.879
These are all legitimate pushes by the real um, or actually, in those cases, Jen, I think that might have been DPR.
00:14:55.279 --> 00:14:57.200
No, they're all well, okay.
00:14:57.279 --> 00:14:58.480
Let's rewind a little bit.
00:14:58.799 --> 00:15:04.000
So Diogo is a legitimate developer who got compromised.
00:15:04.240 --> 00:15:15.200
Uh, we don't know specifically how he did, but probably given his um profile of like an independent developer, is probably through Contagious Interview.
00:15:15.360 --> 00:15:21.519
Um, it looks like it happened maybe around January of this year.
00:15:21.840 --> 00:15:37.279
And um the way that this particular piece of malware works is yeah, it's on your machine, but then it looks for places that it can inject its payload and then pushes them to your repos.
00:15:37.360 --> 00:15:46.000
And so that's what happened is through his normal CI processes, uh infected files were pushed into all of his repos.
00:15:46.320 --> 00:15:59.919
And then because two of those repos serve um as source code for two corresponding NPM projects, when he pushed updates to those npm projects, new versions, the malware came along for the ride.
00:16:00.240 --> 00:16:04.000
And uh that malware was discovered a few months ago.
00:16:04.240 --> 00:16:07.840
It got taken down relatively quickly.
00:16:08.159 --> 00:16:11.440
Um he went through some remediation steps.
00:16:11.600 --> 00:16:19.200
We can see evidence of that where he deleted the files that had the payloads in it, but he only did a partial job.
00:16:19.279 --> 00:16:24.639
He didn't delete the VS Code task.json files that were triggering those payloads.
00:16:24.799 --> 00:16:35.279
And we can assume he also uh didn't properly probably clean his machine and we can look through his repos and we can still see evidence of infection in his repos.
00:16:35.679 --> 00:16:41.600
And whether he continued to push new versions or the threat actor, I would say it's probably him.
00:16:41.840 --> 00:16:45.600
He probably, you know, was making updates to his packages.
00:16:45.840 --> 00:16:55.360
We can see this series of you know updates coming out over the last couple of months where he pushed a new version because he wanted to, you know, have a non-malicious version.
00:16:55.600 --> 00:17:03.840
And then the threat actor was able to push a new uh payload onto his machine.
00:17:04.559 --> 00:17:12.240
And that is through the the wrap that is undoubtedly on his machine, which then trickled its way back into his packages.
00:17:12.400 --> 00:17:18.720
And so May, I think, is when those original poisoned packages were published.
00:17:18.880 --> 00:17:21.359
They've each had a few versions come out since.
00:17:21.519 --> 00:17:23.519
They are all malicious.
00:17:24.240 --> 00:17:31.359
Uh and I think the thing that surprised us was that nobody has caught this.
00:17:31.519 --> 00:17:35.200
These this was a known compromised developer.
00:17:36.000 --> 00:17:39.680
Uh two known compromised packages.
00:17:40.240 --> 00:17:54.160
Not only did we not catch it, um, you know, we'll own our own thing here, NPM didn't catch it, which certainly I would have hoped that they would have, since he should already be on their radar.
00:17:54.240 --> 00:18:01.680
But as you talk about in your blog, they're focused on the package as the important data point, not the individual.
00:18:01.920 --> 00:18:05.119
None of the other scanners seem to have picked it up either.
00:18:05.279 --> 00:18:11.039
So he has had this persistent infection for several months that has had evolved payloads.
00:18:11.200 --> 00:18:13.599
So no fun for him.
00:18:13.920 --> 00:18:30.799
Yeah, I and I think the timeline is important because each victim is a little bit different because what happens is the infection starts on your local machine via um a malicious git repo that gets the payload gets run from VS, typically from VS Code using the task function.
00:18:30.960 --> 00:18:32.559
Sometimes there's other alternative ways.
00:18:32.640 --> 00:18:39.200
There's sometimes there's a git hook, and other times you you run the app, and when you run the app, it actually runs some system commands.
00:18:39.359 --> 00:18:41.359
There's a number of ways, but most of the time it's VS Codes.
00:18:41.519 --> 00:18:43.680
So you're compromised on your machine.
00:18:43.839 --> 00:18:59.440
And then what happens is that allows North Korean threat actors to manipulate files on your machine, they have access to your disk, and what they do is they go and look for all the git repos that you've got, which you said earlier, and they find ones that match what they need, and then they push these payloads in.
00:18:59.599 --> 00:19:02.880
Now, the second part, this is where things sometimes change.
00:19:03.119 --> 00:19:18.480
If they have if North Korea has access to your credentials, because when the info stealer that was part of that rat and part of that kill chain, when the info stealer runs, if they get access to your Git um account via a pat or some other function, then what they do is they will then push.
00:19:18.559 --> 00:19:25.200
And so in Diago's case, there were pushes that our system identifies as non-human.
00:19:25.279 --> 00:19:32.559
So basically, what happened is DPRK orchestrated changes on his local disk to files that were inside of the Git repo.
00:19:32.640 --> 00:19:39.519
It then also orchestrated the push of those out, you know, basically overwrite a commit and then push it out to GitHub.
00:19:39.599 --> 00:19:41.839
So those two things both were automated by DPRK.
00:19:42.160 --> 00:19:47.359
The third thing, which was not automated, which is the publish of the npm package.
00:19:47.519 --> 00:19:52.160
Those were always Diogo himself doing those as part of legitimate work.
00:19:52.319 --> 00:20:00.960
He just didn't realize that his GitHub read repo that was building the NPM package had this, you know, persistent payload sitting on top of it.
00:20:01.200 --> 00:20:05.839
And DPRK pushed three additional payloads into the Git repos.
00:20:06.079 --> 00:20:08.400
So the last one wasn't that long ago, it was just a few days.
00:20:08.480 --> 00:20:15.119
Well, about a week ago now, but and that last one is null receiver, it's the latest version, it's got a brand new campaign marker.
00:20:15.359 --> 00:20:16.240
It's the best.
00:20:16.319 --> 00:20:24.160
And that's the problem with this is that when DPRK has access to your machine and can and has a rat running there, they can keep pushing new better payloads.
00:20:24.400 --> 00:20:26.960
I mean they're helping you out, they're giving you updates, right?
00:20:27.759 --> 00:20:29.200
They're giving you the wrong updates.
00:20:29.839 --> 00:20:30.559
Wrong updates.
00:20:32.000 --> 00:20:34.480
You want to pin their old version of their old malware.
00:20:35.519 --> 00:20:46.559
We've been mapping uh their persistence mechanisms, and there's at least four separate persistence mechanisms related to this campaign.
00:20:46.640 --> 00:21:07.119
Some of it's in the original kill chain, some of it's Pollenwriter specific, but there is a new one um that somebody in the community surfaced maybe a week or two ago, where they have now added a step in their kill chain where they overwrite the npm CLI with a malicious version of the CLI.
00:21:07.759 --> 00:21:09.680
That's a particularly nasty one.
00:21:09.839 --> 00:21:25.920
So even if you clear off everything else that we've been talking about for months, this little malicious npm CLI, the next time you fire up npm, we'll say reinstall malware, and it just kicks off the whole thing again.
00:21:26.240 --> 00:21:49.920
If you if you find the the Python or the JavaScript persistence, the rat and you kill that and you find where it's starting from, from a bash RC file or an NPM RC file or wherever it is, if you kill that, if you get it out of there, if you know if you go and look and find all the payloads and all your git repos and get rid of those and actually remove them from your git index, because just pushing a new version of it doesn't mean that the payload's gone.
00:21:50.000 --> 00:21:52.160
It just means you've got a new version that doesn't have the payload.
00:21:52.319 --> 00:21:59.839
If you do all those things alone, but you don't uninstall or delete npm, you're gonna get reinfected because the next time you run npm.
00:22:00.160 --> 00:22:00.640
NPM.
00:22:00.799 --> 00:22:15.279
It's so basically the normal size of NPM, which by the way is just a NPM CLI is just basically a bunch of like um simlinks to different JavaScript files, most of which end up in a uh in a CLI folder inside the NPM.
00:22:15.359 --> 00:22:16.160
Anyhow, it's crazy.
00:22:16.319 --> 00:22:16.960
Why would you do that?
00:22:17.039 --> 00:22:18.240
But it's JavaScript.
00:22:18.400 --> 00:22:23.680
Um, they overwrite that 200-byte file with a file that ends up being something like a thousand K or something.
00:22:23.759 --> 00:22:24.640
Yeah, I think it's big as well.
00:22:24.720 --> 00:22:26.880
I think it's I think it's 1100K or something like that.
00:22:27.119 --> 00:22:30.480
Um, but it's and and some people, you know, we didn't even do this.
00:22:30.559 --> 00:22:35.759
Some people out there in the open in the wild have created tests um for some of this stuff.
00:22:35.839 --> 00:22:40.240
So and and we've pulled that into our blog and also shout it out to them too as well.
00:22:40.319 --> 00:22:45.920
So there's some really simple things you can do to look at the size of your npm file, for example.
00:22:46.079 --> 00:22:48.240
Um, just make sure you're following the simlinks.
00:22:48.319 --> 00:22:50.400
So if not, then not gonna work.
00:22:50.640 --> 00:23:01.200
Yeah, the other thing that you said you've been observing is um so there's two kinds of files that this malware will create on your machine or modify on your machine.
00:23:01.279 --> 00:23:04.400
We've talked extensively about the task.json files.
00:23:05.119 --> 00:23:13.839
We are still seeing um lots of ones that are config files, JavaScript or TypeScript config files.
00:23:14.079 --> 00:23:27.519
And Paul, you said that initially they tended to save those in index, but now you are seeing them all over the place that they're just spread and it's not, you know, three or four different types of files.
00:23:27.599 --> 00:23:29.839
It's really just any kind of config.
00:23:30.079 --> 00:23:32.720
Talk a little bit more about what you've been observing.
00:23:33.039 --> 00:23:34.240
Yeah, good call out.
00:23:34.400 --> 00:23:59.200
Um, so in the original version of Pawn Rider from from March of 2026, um, basically what happens is in that in that part of the kill chain where their malware is going and looking for JavaScript files to write into, it was only looking for five or six files wite.config.js and and you know babel.config.json and just a very small number.
00:23:59.279 --> 00:24:04.799
And then that number grew over the next couple of months, and you know, they were looking for like 15 or 16 different files.
00:24:04.880 --> 00:24:07.759
And if they find that, they would just append their payload on the end of it.
00:24:07.920 --> 00:24:11.759
Well now they're just looking for any JavaScript file.
00:24:12.079 --> 00:24:21.599
Any and what what they're also doing, Jen, is they is they're looking for files that are actually getting used as part of the execution order for that particular project.
00:24:21.680 --> 00:24:26.319
So that's what's smart about it, is that they don't just go and find some like random JavaScript file.
00:24:26.400 --> 00:24:36.240
They basically look at the code and really briefly take a look at kind of how that how the call um process works, and then they find a JavaScript file that's actually gonna get called and they drop it into there.
00:24:36.319 --> 00:24:38.160
So reachability.
00:24:38.400 --> 00:24:39.039
Yeah, exactly.
00:24:39.119 --> 00:24:40.160
It was really, really well.
00:24:40.240 --> 00:24:44.240
I it's very simplistic reach of reachability.
00:24:44.559 --> 00:24:46.240
But that's funny.
00:24:46.559 --> 00:24:50.799
Um but uh so we're seeing it now in all kinds of stuff.
00:24:50.880 --> 00:24:59.519
So basically, this is one of the things, this is why our hunt keeps growing is that you know we had that original five or six files they were looking for, then we had like the 10 or 8 or whatever, and then it was grew and grew.
00:24:59.599 --> 00:25:05.599
And now we just look for any types, types, any here's the extensions you want to look for.js, obvious.
00:25:05.759 --> 00:25:09.920
Um, excuse me, dot TS TypeScript also probably should be uh obvious.
00:25:10.079 --> 00:25:19.920
Then all the minified in the the the um uh the ESM and common uh JS files, CJS, mjs, and that whole kind of thing.
00:25:20.160 --> 00:25:26.559
So there's like five or six extensions you want to look for, um, which means that your searching now is gonna be you know longer.
00:25:26.640 --> 00:25:30.960
It's gonna be more, it's gonna take more time because you're looking through a lot more files, but you know, that's what you got to do.
00:25:31.039 --> 00:25:35.200
And when we're doing that now in GitHub out there forward hunting, we're just finding a lot more files.
00:25:35.359 --> 00:25:41.920
I pushed like, I don't know, 1200 or 1400 new GitHub repos to OSM just yesterday, one day.
00:25:42.559 --> 00:25:50.160
Um, you said something that gives me an opportunity to get up on my soapbox, and I know you're gonna join me up on it.
00:25:50.400 --> 00:26:06.960
Um, because this takes so much time, uh, this is not just about like cleaning your own stuff and worrying about yourself for every minute, hour, day that you're going through incident response.
00:26:07.119 --> 00:26:14.480
If you have public repos, if you're collaborating with anyone, uh the infection is spreading to your network.
00:26:14.720 --> 00:26:17.920
And I know that disclosures suck.
00:26:18.400 --> 00:26:20.160
Nobody likes to do that.
00:26:20.480 --> 00:26:26.400
But if you found that you've been infected, uh, please, please, you know, disclose.
00:26:26.559 --> 00:26:41.759
Tell people in your network that you know are collaborating, not just because it's the right thing to do for the community, but if you clean out all signs of infection and then you're still collaborating with people who are infected, you're just gonna get reinfected.
00:26:41.839 --> 00:26:49.759
So if you don't give them the opportunity to look for signs of compromise and address it, you're hurting yourself in addition to them.
00:26:50.240 --> 00:26:52.559
100, oh my god, great call out.
00:26:52.880 --> 00:26:55.359
Um, and we are see we are genuinely seeing that.
00:26:55.519 --> 00:27:04.480
So people they they say, oh, some, you know, like for example, I'm automating disclosures now into open source projects that we find Pollen Rider in.
00:27:04.640 --> 00:27:10.480
Well, basically, we have an automation thing that goes out there and drops an issue into the GitHub issues for that particular project.
00:27:10.720 --> 00:27:15.599
What'll happen is they'll see that, then they'll remove it from the GitHub repo and they won't say anything.
00:27:15.759 --> 00:27:18.079
They'll close the issue and they won't say anything, right?
00:27:18.240 --> 00:27:26.000
But then the problem is that somebody inside one of their contributors and maintainers, or sometimes multiple, uh, will still be infected on their laptops and the whole thing will just come back.
00:27:26.079 --> 00:27:33.519
And we've now seen that with some of these open source projects where it started out as one or two people inside of the contributor group had it, and now they're all infected.
00:27:33.599 --> 00:27:38.480
It's like COVID, except you can't build up an immunity, you can just get it immediately again, right?
00:27:38.640 --> 00:27:45.279
So um, to your point, I think we need to do a lot better at just saying, hey, listen, I got hacked.
00:27:45.440 --> 00:27:48.640
Um, and here's what you know, here's what we did.
00:27:48.799 --> 00:27:56.559
We suggest you do the same thing, and here's the things to look for, and reference our that great um blog post that you put together, Colin Rider for for developers.
00:27:56.799 --> 00:27:57.440
Yeah, thank you.
00:27:57.519 --> 00:27:59.200
I'll drop that link in the chat.
00:27:59.359 --> 00:28:03.839
I put together a little incident response remediation guide.
00:28:04.559 --> 00:28:08.480
Um you know, this conversation.
00:28:08.720 --> 00:28:13.440
Um, hold on, I can type and talk at the same time, I swear.
00:28:14.720 --> 00:28:23.279
Um this reminds me of you know, the whole there's two kinds of companies, those that have been compromised and those that don't know they've been compromised.
00:28:23.519 --> 00:28:27.680
I think we're you know, this is this is a similar thing.
00:28:27.839 --> 00:28:33.440
Um, this is spreading widely, it's evolving rapidly.
00:28:33.920 --> 00:28:38.400
Um the signals are constantly changing.
00:28:38.559 --> 00:28:51.599
You know, we're constantly updating our own internal detections because what was reliable weeks or months ago is no longer being used or not being used as widespread.
00:28:51.759 --> 00:29:04.240
Um, so yeah, I guess this is a plug for having some intel on PollenWriter so you know what to look for, but start with the blog that I wrote because it'll at least give you some places to look for.
00:29:06.720 --> 00:29:08.160
Excellent, excellent advice.
00:29:08.400 --> 00:29:09.279
I have nothing to add.
00:29:09.519 --> 00:29:09.920
Nothing to do with that.
00:29:12.720 --> 00:29:14.799
Okay, let's wrap it there.
00:29:14.960 --> 00:29:22.160
Um as a heads up to our dedicated listeners, of which there are some, which we love.
00:29:22.559 --> 00:29:32.640
Um, we are gonna take a break next week for a little much needed uh vacation time slash family time on each side.
00:29:32.799 --> 00:29:41.279
And then we're gonna figure out when, how, where to record an episode while we are in Strasbourg.
00:29:41.759 --> 00:29:47.039
Um coming up uh in the first week of, or I guess second week of September.
00:29:47.119 --> 00:29:57.119
So very much looking forward to another uh live from the conference, Jen and Paul talking about what we've uh been experiencing, learning, etc.
00:29:57.599 --> 00:29:59.279
And hopefully I'm not sick this time.
00:29:59.599 --> 00:30:02.000
You're not gonna be sick this time, you're gonna be so healthy.
00:30:02.319 --> 00:30:04.960
Um my my immune system's all jacked up now.
00:30:05.119 --> 00:30:10.880
Um yeah, just to kind of double click on that, we will be in Europe uh September 6th to 11.
00:30:11.039 --> 00:30:14.079
Um uh seven to 10.
00:30:15.440 --> 00:30:18.960
Um, yeah.
00:30:19.119 --> 00:30:21.119
Oh, sorry, the conference is the seventh.
00:30:21.359 --> 00:30:24.559
Yeah, I'm also gonna be yeah, I'm gonna be there September 11th too as well.
00:30:24.720 --> 00:30:32.640
I'm actually talking at uh I'm actually sorry, I'm giving training on GitHub CTI stuff at uh Frankfurt B size on the 11th.
00:30:32.720 --> 00:30:36.000
I'm having dinner with some friends the night before, so I'm really looking forward to this.
00:30:36.160 --> 00:30:41.599
Um, so yeah, if you're gonna be in Frankfurt or Strasbourg um for whatever reason, let us know.
00:30:42.400 --> 00:30:48.559
We have a lot of users in Europe, so we have a disproportionate number of OSM users in Europe.
00:30:48.720 --> 00:30:50.400
So come out and say hi.
00:30:51.119 --> 00:30:52.880
On that note, have a good one.
00:30:53.119 --> 00:30:54.000
Yeah, thanks for listening.
00:30:54.079 --> 00:30:55.119
We really really appreciate it.
