Threat Research

SentinelSneak: Malicious PyPI module poses as security software development kit

Securonix

Two researchers uncovered a malicious PyPI package masquerading as a SentinelOne SDK client, named “SentinelSneak,” which actually implements a backdoor and data-exfiltration capabilities. The campaign highlights open-source software supply-chain risks, especially through typosquatting and impersonation of well-known vendors.
#SentinelSneak #PyPI #SentinelOne

Keypoints

  • Malicious PyPI package impersonates SentinelOne by presenting as a legitimate SDK client.
  • The backdoor and data-exfiltration features are located in two api.py files within the package.
  • The malicious code does not execute on installation; it waits to be called programmatically before activation.
  • Exfiltrated data includes development-environment information like SSH keys and command history, sent to a C2 server.
  • Indicators include IP-address references in URLs and network strings found in the code.
  • The campaign is tied to broader open-source supply-chain risks, including typosquatting and multiple similar-named packages.

MITRE Techniques

  • [T1059.006] Python – The package uses Python code and is triggered when called programmatically. Quote: “the malicious functionality in the library does not execute upon installation, but waits to be called on programmatically before activating.”
  • [T1195] Supply Chain – Typosquatting and impersonation of a popular vendor to push malicious code. Quote: “typosquatting, with many of the malicious packages using naming that was similar to popular npm packages…”
  • [T1036] Masquerading – Impersonation of SentinelOne as a legitimate SDK. Quote: “The SentinelOne PyPI package we discovered has no connection to SentinelOne, the respected cybersecurity firm…”
  • [T1083] File and Directory Discovery – Enumeration of files and directory contents, plus root directory listing. Quote: “enumeration of files in a given directory, deleting of a file/directory and creation of a new process.”
  • [T1041] Exfiltration Over C2 Channel – Data exfiltration to a remote command-and-control server. Quote: “The data is then exfiltrated to the command and control (C2) server.”
  • [T1071.001] Web Protocols – Use of HTTP/S with IP-referenced hosts in URLs. Quote: “presence of URLs that reference the host by IP address…”
  • [T1552.001] Credentials in Files – Exfiltration targets including SSH keys and secrets stored under .ssh. Quote: “contents of the .ssh folder containing ssh keys and configuration information, including access credentials and secrets, related to git, kubernetes and AWS services.”
  • [T1027] Obfuscated/Hidden Content – Hidden or obfuscated functionality in the malicious code. Quote: “hidden (obfuscated) functionality…”

Indicators of Compromise

  • [IP Address] Data exfiltration host – 54.254.189.27
  • [SHA-1 Hash] Malicious package fingerprints – 68b09896b65db21d2c6cd2923d2486a2f69f73ef, 557af28f0a42d4fb7466376ce422bcb518e7ccc0
  • [Package Name] PyPI packages involved – SentinelOne (various versions), sentinelone-sdk, sentinelOneSDK, sentinelOneSDK (and 2 more hashes)
  • [SSL Certificate] Self-signed certificate details linked to the IP – SHA1 2a12e17eff9a485f03dc707a6be76ecb23aded7e, Serial 110586408742899611342786376272762984188488572179; Issued 2022-12-11; Expires 2023-12-11
  • [File Name] Malicious module files – api.py (in two files within the package)

Read more: https://blog.reversinglabs.com/blog/sentinelsneak-malicious-pypi-module-poses-as-security-sdk