A sophisticated remote access trojan (RAT) called Xeno RAT has been openly published on GitHub, enabling threat actors to access and customize this capable malware easily. Developed from scratch in C# for Windows systems, Xeno RAT boasts features like audio recording, SOCKS5 proxies, hidden virtual networking, and a builder to create variants. The same developer previously released the DiscordRAT malware. Recently, threat actors employed Xeno RAT’s customization to craft a malware downloader relying on shortcuts and the Discord CDN for obfuscation. After escalating privileges, it achieves persistence and phones home to a command server, exhibiting hallmarks of remote access malware. The open availability of Xeno RAT allows this threat to spread rapidly.

Impact: The accessibility of the advanced malware allows threat actors with limited skills or resources to conduct sophisticated cyber attacks and compromise remote systems. Variants can evade defenses amidst widespread vulnerability. Additionally, post-compromise features enable extensive monitoring, control, and data exfiltration.

Recommendation: Organizations should monitor for Indicators of Compromise related to Xeno RAT Additionally, organizations should encourage reporting of suspicious activities and maintain regular data backups to mitigate the impact of a potential breach.

North Korean state-sponsored hackers have been discovered targeting developers through the distribution of fake npm packages on the Node.js repository. These malicious packages, execution-time-async, data-time-utils, login-time-utils, mongodb-connection-utils, and mongodb-execution-utils, masquerade as legitimate utilities but actually install malicious scripts, including cryptocurrency and credential stealers. The attackers have employed sophisticated techniques to obfuscate the malicious code and conceal it within seemingly innocuous test files. Connections to North Korean actors have emerged, with similarities to previous malware campaigns codenamed Contagious Interview. The attackers have been observed adapting their tactics, including self-hosting the malicious npm dependencies and using social engineering tactics to lure developers.

Impact: This attack threatens developers and any organization that uses open source JavaScript components. The malware could lead to stolen credentials, sensitive data theft, system compromise, and more. If trusted developers are compromised, there is risk that the supply chain is polluted with vulnerabilities.

Recommendation: Developers should review the reputation and source of npm packages before installation, especially those with low download counts or suspicious naming conventions.