Tech Support
Documentation
Login
Contact Us
Alert: NuGet Package SeroXen RAT Threat to .NET Developers
Wajahat Raja
October 24, 2023 - TuxCare expert team
In a recent security issue, a deceptive NuGet package threatens .NET developers with the deployment of the SeroXen RAT, a harmful remote access trojan. Because the .NET framework is no longer limited to Windows, this occurrence has far-reaching repercussions, even for Linux and Mac systems. In this blog, we’ll go into the specifics of this NuGet Package SeroXen RAT threat and its ramifications for developers across platforms.
The Malicious NuGet Package SeroXen RAT Package Discovery
A rogue package named “Pathoschild.Stardew.Mod.Build.Config” has been discovered on the NuGet package manager, specifically targeting .NET developers security. This fraudulent package, authored by a user under the alias “Disti,” impersonates a legitimate package called “Pathoschild.Stardew.ModBuildConfig.” Security experts from Phylum, a software supply chain security firm, recently released a report highlighting this dangerous development.
Nearly 79,000 people have downloaded the real “Pathoschild.Stardew.ModBuildConfig” package. In a clever maneuver, the malicious strain artificially increased its download count by exceeding 100,000 downloads after its October 6, 2023 release.
Suspect Profile and Crypto Library Impersonation
The person behind the malicious package has a history of issuing false packages, weakening faith in the .NET development community even further. In this scenario, six more packages written by the same profile have achieved over 2.1 million downloads. Four of these deceptive packages, which masquerade as libraries for various cryptocurrency services such as Kraken, KuCoin, Solana, and Monero, are all designed to deploy the SeroXen RAT.
Initiating the Attack
The attack is initiated during the installation of the deceptive package. This procedure is dependent on a script called “init.ps1”. This script has been deprecated, but it still works when installing a NuGet package without causing any warnings. Attackers can enter arbitrary commands into the “init.ps1” script, which JFrog previously exposed in March 2023.
Within the deceptive package analyzed by Phylum, the PowerShell script is used to download a file named “x.bin” from a remote server. This file is actually a deeply disguised Windows Batch script. This script is in charge of creating and executing another PowerShell script, which leads to the deployment of the SeroXen RAT.
SeroXen RAT: A Closer Look
SeroXen RAT is a fileless remote access trojan that can be purchased for $60 for a lifetime license. Its powers are a combination of the Quasar RAT, the r77 rootkit, and the Windows command-line application NirCmd. This combination provides fraudsters with broad control as well as the ability to conduct covert and malevolent actions.
This discovery underscores a concerning trend where attackers exploit open-source ecosystems to target developers. These ecosystems rely on trust and collaboration, making them susceptible to exploitation by malicious actors.
Expanding Threats Beyond .NET
The significance of this threat extends beyond the .NET developer community. As .NET has expanded to run on Linux and Mac systems, a wider audience must be made aware of the risks associated with deceptive packages. These attacks can compromise security, even on non-Windows platforms.
The malicious NuGet packages detected are not isolated events. A similar operation was discovered on the Python Package Index (PyPI), with packages imitating actual products from well-known cloud service providers such as Aliyun, Amazon Web Services (AWS), and Tencent Cloud. These forgeries secretly communicate sensitive cloud credentials to an obfuscated external URL.
The Importance of Subtlety in Attack Strategy
One striking aspect of these attacks is the subtlety employed by the attackers. They aim to preserve the original functionality of the packages, intending to fly under the radar. The attack is minimalistic and straightforward yet highly effective. These tactics focus on exploiting the trust that developers place in established codebases.
The attackers behind these deceptive packages have not limited themselves to one specific geographical area. Downloads of counterfeit libraries have been primarily observed in the United States, followed by China, Singapore, Hong Kong, Russia, and France. This international reach emphasizes the global nature of these threats.
A Continued Challenge for Developers
These incidents are part of an ongoing, increasingly sophisticated campaign to compromise software supply chains. Earlier, Checkmarx exposed a campaign that infiltrated PyPI with 271 malicious Python packages designed to steal sensitive data and cryptocurrency from Windows hosts. So, protecting NuGet dependencies should be a top priority in your cybersecurity strategy.
Responding to the Threat
An update on the situation reveals that the six remaining packages published by “Disti” on NuGet, including KucoinExchange.net, Kraken.Exchange, SolanaWallet, Modern.Winform.UI, Monero, and DiscordsRpc, are no longer available. This reflects ongoing efforts to mitigate these threats.
Conclusion
The discovery of a malicious NuGet package causing the SeroXen RAT attack serves as a stark reminder of the risks within open-source ecosystems. Developers, regardless of their operating system, must remain vigilant and adopt robust security practices to protect their projects and the integrity of their supply chains.
Cybersecurity for .NET developers is a paramount concern in today’s digital landscape. Staying educated is your best defense in a world where digital threats know no bounds. Whether you’re a .NET developer on Windows or a developer working across various platforms, security vigilance is a shared responsibility. Trust but verify and safeguard your projects from deceptive packages and potential security breaches.
The sources for this piece include articles in The Hacker News and SC Media.
