Objective
Gain persistent remote access to developer machines and steal credentials.
Packages
Indicators
- domain xienztiavkygvacpqzgr.supabase.cocommunicates-with
- domain ndfcioahsbgsjmulpjgt.supabase.cocommunicates-with
- sha256 4600db4fc30fb6ffa68deed4a25679e674bb3a3e8dae31f3dfc83bea0d757a8findicates
- sha256 2e131f47090516e5a60553aa40d46823e08162390c1d6deb075cf317f00309f7indicates
- email tanvisoul9@gmail.comexfiltrates-to
- domain 152.67.0.53communicates-with
- ipv4 152.67.0.53communicates-with
- ipv4 216.126.237.71communicates-with
Techniques
- ttp T1195.001 Supply Chain Compromise: Compromise Software Dependencies and Development Toolsuses
- ttp T1059.007 Command and Scripting Interpreter: JavaScriptuses
- ttp T1041 Exfiltration Over C2 Channeluses
- ttp T1552.004 Unsecured Credentials: Private Keysuses
- ttp T1105 Ingress Tool Transferuses
- ttp T1071.001 Application Layer Protocol: Web Protocolsuses
- ttp T1102 Web Serviceuses
- ttp T1546 Event Triggered Executionuses
- ttp T1552.001 Unsecured Credentials: Credentials In Filesuses
- ttp T1539 Steal Web Session Cookieuses
