Qubitstrike – An Emerging Malware Campaign Targeting Jupyter Notebooks

MITRE Techniques

• [T1059.004] Unix shell – The malware was first observed to open a Bash session on the Jupyter honeypot, indicating command and scripting activity. “[The attacker] opened a Bash instance using Jupyter’s terminal feature.”]
• [T1105] Ingress Tool Transfer – It downloads and executes the main script via curl from a Codeberg repository, with base64 encoding used to obfuscate the command. “[This downloads and executes the main script used by the attacker. The purpose of base64 encoding the curl command is likely to hide the true purpose of the script from detection.”]
• [T1021.004] SSH – The malware propagates to related hosts via SSH, enabling worm-like spread. “[Propagating the malware to related hosts via SSH]”
• [T1053.005] Cron – It registers persistent cron jobs (apache2, apache2.2, netns, netns2) to run the miner and payloads on reboot or daily. “[Registering cron persistence and inserting a attacker-controlled SSH key]”
• [T1014] Rootkit – The Diamorphine rootkit is retrieved/installed to hide attacker processes, via kernel module and LD_PRELOAD fallback. “[Retrieving and installing the Diamorphine rootkit]”
• [T1070] Indicator Removal on Host – Antiforensics measures delete various Linux log files to cover tracks. “[log_f() performs some antiforensics measures by deleting various Linux log files]”
• [T1071.001] Web Protocols – Discord C2 is used, embedding a Discord bot as the command-and-control channel. “[Discord C2 … uses a Discord bot as a C2]”
• [T1552.001] Credentials in Files – The campaign hunts for cloud provider credential files and exfiltrates them via Telegram. “[Hunts for a number of hardcoded credential files for popular cloud services … exfiltrates these via the Telegram Bot API]”