Distributed npm Package Cluster Delivers Cross-Platform RAT Targeting Alibaba Developers

MITRE Techniques

• [T1027 ] Obfuscated Files or Information – The malicious code hid in configuration rules and was camouflaged inside a normal-looking expression (‘the code pretends to be a normal configuration rule’).
• [T1059.007 ] JavaScript – The initial loader and payload logic were implemented in JavaScript within npm packages (‘fetching a hardcoded remote JavaScript payload using curl’).
• [T1059.006 ] Python – Persistence was achieved by patching Python scripts in .skills directories to launch malicious code (‘patching Python scripts located inside .skills directories’).
• [T1105 ] Ingress Tool Transfer – The campaign downloaded multiple stages from attacker-controlled GitHub and Alibaba Cloud infrastructure (‘downloads a third-stage setting.js payload’ / ‘downloads a binary payload’).
• [T1055 ] Process Injection – The RAT used code injection into targeted tools by modifying their scripts to execute the malicious payload (‘poisoning of AI-tools by patching Python scripts’).
• [T1546.011 ] Event Triggered Execution: Application Shimming / Script Modification – Modified startup-related files to trigger execution on launch (‘Inserts malicious background script into ~/.zshrc’).
• [T1547.001 ] Registry Run Keys / Startup Folder – On macOS, persistence was established via Launch Agent and shell startup files (‘sets up a 10-minute Launch Agent’).
• [T1021 ] Remote Services – The final payload supported lateral movement and remote interaction across systems (‘DingTalk lateral movement’ / ‘encrypted reverse TCP proxy’).
• [T1053.005 ] Scheduled Task/Job: Scheduled Task – macOS persistence included a timed Launch Agent, functionally similar to scheduled execution (‘sets up a 10-minute Launch Agent’).
• [T1041 ] Exfiltration Over C2 Channel – The RAT supported data exfiltration and polling of commands via C2 (‘command execution, arbitrary file upload and download’).
• [T1110 ] Brute Force – Not mentioned.
• [T1204 ] User Execution – The malicious packages were activated when targets installed dependency trees (‘trigger the installation of the dependency tree’).
• [T1059.012 ] Command and Scripting Interpreter: Node.js – The attack relied on Node.js package execution, require(), and the vm module (‘uses the vm module for isolated expression evaluation’).
• [T1059.004 ] Unix Shell – The RAT forwarded arbitrary commands to the local operating-system shell (‘anything else is forwarded to the local operating-system shell’).