Hackers Attack .NET Developers Using Malicious NuGet Repository Packages

There is a concerning trend among cybercriminals targeting individuals working with the .NET framework using a sneaky tactic called typosquatting.

This involves creating fake packages that mimic the names of legitimate software and distributing them through the popular NuGet repository.

Cybersecurity researchers Natan Nehorai and Brian Moussalli from JFrog have detected this ongoing campaign involving malicious software distribution through fraudulent packages.

 

However, it is also possible that the cybercriminals behind this attack deliberately sought to legitimize their fake packages by artificially inflating download numbers.

In addition to distributing fraudulent packages through the NuGet repository, the cybercriminals responsible for this attack also employed a technique known as typosquatting.

 

Malicious Packages Discovered

There are a number of NuGet packages that contain the same malicious payload that experts have determined:-

The malicious packages distributed through the fraudulent NuGet repository contain a PowerShell-based dropper script called init.ps1, designed to download and execute on the targeted machine.

 

After executing the PowerShell-based dropper script, the malicious packages download and launch a second-stage payload. This payload is a custom-built Windows executable designed specifically for this attack.

The malware that is deployed on compromised systems is capable of carrying out various malicious activities.

Spotting Malicious NuGet Packages

Here below, we have mentioned all the key points:-

• A developer’s first responsibility should be to ensure they do not import or install packages with typos.
• Certain packages employ a tactic where they imitate the names of established and reputable packages, expecting that a programmer may unintentionally incorporate them into their project or specify them as a requirement.
• Users can also safeguard themselves against installing potentially harmful packages by carefully inspecting the installation and initialization scripts for any suspicious code or activity.
• Keep an eye out for scripts that will retrieve and execute resources from external sources when you run them.
• Ensure no scripts or binary files are mistakenly executed when downloading the package locally.
• The low download count of a relatively new package may indicate a risk.

The current attack is just one aspect of a wider-ranging, malicious campaign. This campaign involves multiple attackers who have taken the bold step of uploading over 144,000 packages related to phishing onto various open-source package repositories.