NodeCordRATMalware
NodeCordRAT is a cross-platform Remote Access Trojan and information stealer written in Node.js that targets Windows, macOS, and Linux systems through malicious NPM packages in software supply chain attacks. The malware executes automatically when developers unknowingly install compromised dependencies, providing attackers with comprehensive system access and data exfiltration capabilities.From MISP Galaxy
Last reported 9 months ago, by Zscaler ThreatLabz1 report
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1102Web Service
“…ation DiscoveryThe script implicitly relies on network access to establish the Discord connection and C2 channel.Command and Control (C2)T1102.002Web Service: Social MediaThe script uses the Discord API as its primary C2 communication channel for sending and receiving commands, a…”
- T1553.002Code Signing
“…53cb0333c68baf97449c MITRE ATT&CK FrameworkTacticTechnique IDTechnique nameDescriptionInitial AccessT1588.006Obtain Capabilities: Code Signing CertificatesThe attacker creates a compelling narrative around a legitimate-looking npm package (via typosquatting) that contain…”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Malicious NPM Packages Deliver NodeCordRAT“Malicious NPM Packages Deliver NodeCordRAT”
Indicators in its reports
named in the reports above- project[.]inin 1 report
- hxxps://github[.]com/bitcoinjs/bitcoinjs-lib.gitin 1 report
Copy these 2 indicators · defanged
Thanks — we review every report.