Linux-Malware · CuraSec

tag: Linux-Malware · 2 items

Engineer — Learn: No HAProxy vulnerability is involved — attackers needed prior code execution to recompile and replace the binary. This illustrates why runtime binary integrity checks (e.g., file hashing, dm-verity, or package-manager verification) on critical reverse-proxy binaries matter; no immediate patching action required.
SOC/IR — Learn: The technique — compiling a backdoor directly into a modified HAProxy binary — is a stealthy persistence method worth understanding, but no IOCs, ATT&CK mappings, or broader campaign details are available from this report to act on today.
Leader — Skip

Engineer — Act: Active supply-chain compromise in npm packages is an Act signal regardless of KEV status — audit your dependency tree immediately for these 14 packages masquerading as calendar/streak utilities and check CI build logs for processes spawned by node_modules executing detached binaries.
SOC/IR — Plan: The implant’s load behavior — extracting a bundled binary, chmod-ing it, and launching it as a detached process — is a detectable Linux TTP; build or tune EDR rules to alert on node/npm processes spawning unexpected child executables, but the summary lacks IOCs or package names needed to hunt right now.
Leader — Plan: An active npm supply-chain campaign using AI-assisted C2 signals an escalating threat class; this quarter, direct engineering to verify SCA tooling covers npm and confirm your CI pipelines would catch a malicious package load before it reaches production.