MALFEX – A malicious npm postinstall no advisory has caught for fourteen months

MITRE Techniques

• [T1195.001 ] Compromise Software Dependencies and Development Tools – The operator abused npm packages and dependency wrappers to deliver payloads through the software supply chain (‘uploaded at least nine packages to npm’ and ‘dependency wrappers that deliver an existing payload under a new install name’).
• [T1204.002 ] User Execution: Malicious File – The campaign relied on installs and execution paths that trigger payloads during package installation (‘postinstall’ and ‘executes a build of overlord-client’).
• [T1105 ] Ingress Tool Transfer – Payloads were retrieved from external infrastructure and public hosts (‘downloads a Windows PE executable disguised as image/png’ and ‘fetches a 64 MB Node.js bundle from 104.234.65.75:700’).
• [T1027 ] Obfuscated Files or Information – The payload chain used encryption, polyglots, and encoded loaders to hide content (‘PNG polyglot’, ‘encrypted payload’, ‘EA06 encrypted a3x’, ‘cycled-XOR strings, RC4 key 8448433, and LZNT1’).
• [T1218.010 ] System Binary Proxy Execution: AutoIt – A signed AutoIt3 interpreter was used to run the malicious script (‘extracts an IExpress cabinet containing a signed AutoIt3 interpreter and encrypted script’).
• [T1564.001 ] Hide Artifacts: Hidden Files and Directories – The malware dropped executable files with innocuous-looking names and used masquerading to blend in (‘disguised as image/png’ and ‘dropped filenames gldriver_pre_core.exe and gldriver_pre_asset.exe’).
• [T1053.005 ] Scheduled Task/Job: Scheduled Task – Persistence artifacts included a Windows scheduled task (‘the Maiden scheduled task’).
• [T1036 ] Masquerading – The malicious executable was presented as benign content or leveraged trusted-looking names (‘disguised as image/png’ and ‘benign reputation cover’).
• [T1071.001 ] Application Layer Protocol: Web Protocols – Command-and-control and data retrieval used web-based services and webhook traffic (‘raw.githubusercontent.com/cavecrew/proj’ and ‘Discord webhook’).
• [T1056.001 ] Input Capture: Keylogging – The report describes a Windows credential stealer and browser/Telegram harvesting behavior (‘a Windows credential stealer’ and ‘harvests browser and Telegram tdata’).
• [T1055 ] Process Injection – The report states that the payload injects into Discord clients (‘injects into Discord clients’).
• [T1021.004 ] Remote Services: SSH/SMB? – Not mentioned; omitted.