Ethersphere project targeted in supply chain attack - SC Media
Attackers compromised the Ethersphere project by distributing malicious versions of the bee-js library and Swarm Desktop application via its internal release automation.
The malicious releases targeted bee-js version 13.3.0 and Swarm Desktop version 0.56.2, designed to exfiltrate sensitive wallet keys and passwords from user systems.
Upon execution, the malware installs persistent backdoors on Windows, macOS and Linux machines, sharing infrastructure with the SleepyDuck malware.
The attackers leveraged stolen continuous integration credentials to bypass security checks, allowing the malicious code to carry valid provenance records.
Remediation steps required
While the compromised versions have been removed and replaced with clean updates, security experts warn that these measures do not automatically remediate existing infections.
Users are advised to treat any machine that ran the affected software as fully compromised, rotate all exposed credentials and perform a clean rebuild of affected systems.
The incident highlights the significant risks associated with automated software supply chains and the potential for attackers to exploit trusted build pipelines to deliver malicious payloads to unsuspecting users.
Related
