Full Report
Cybersecurity researchers have discovered a new set of malicious npm packages that target users of Alibaba developer tools with a cross-platform remote access trojan (RAT) as part of a sophisticated, targeted software supply chain attack targeting Chinese-speaking environments. One of the packages in question is "lib-mtop," an unscoped package with the same name as a private Alibaba package
Analysis Summary
Based on the technical report provided, here is the summary of the identified malware and its associated techniques.
# Tool/Technique: Alibaba-Targeted Supply Chain RAT
## Overview
This is a sophisticated software supply chain attack targeting Chinese-speaking developers, specifically those using Alibaba developer tools. The attack utilizes "dependency confusion" and "typosquatting" by publishing malicious npm packages with names identical to private, internal Alibaba packages (under the `@ali` scope) to infiltrate corporate environments.
## Technical Details
- **Type:** Malware (Cross-platform Remote Access Trojan / Backdoor)
- **Platform:** Windows, macOS, Linux
- **Capabilities:** Command execution, file manipulation, reconnaissance, persistence via app injection, and lateral movement.
- **First Seen:** Initial versions in November 2023; malicious activity escalated in March/April 2024.
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1195.001 - Supply Chain Compromise: Compromise Software Dependencies]
- **[TA0003 - Persistence]**
- [T1546.004 - Event Triggered Execution: .bash_profile, .bashrc, .zshrc]
- [T1543.001 - Create or Modify System Process: Launch Agent]
- **[TA0005 - Defense Evasion]**
- [T1027 - Obfuscated Files or Information] (Loader logic split across multiple packages)
- [T1140 - Deceptive File Names] (Masquerading as legitimate Alibaba OSS domains)
- **[TA0011 - Command and Control]**
- [T1105 - Ingress Tool Transfer]
## Functionality
### Core Capabilities
- **Cross-Platform Payload Execution:** Custom logic for Windows, Linux, and macOS.
- **Data Exfiltration/Management:** Arbitrary file upload and download.
- **Host Reconnaissance:** Collecting information about the infected environment.
- **Remote Shell:** Executing arbitrary commands from the C2 server.
### Advanced Features
- **App Injection:** Specifically targets enterprise collaboration tools (DingTalk, Wukong, Qoder) to maintain persistence and potentially intercept communications.
- **Endpoint Security Termination:** On Windows, the malware identifies and terminates "Alilang" (an Alibaba enterprise security/VPN app) and replaces its core code with a trojanized version.
- **Stealth Execution:** On Linux, the binary is executed as a detached process and immediately deleted from the disk to reside only in memory.
## Indicators of Compromise
- **File Names:** `lib-mtop`, `aone-kit`, `aone-kit-cli`, `aone-sandbox`, `local-config-parser`, `smart-config-manager`.
- **Network Indicators:**
- `aone-cli-next[.]oss-cn-beijing[.]aliyuncs[.]com` (C2/Payload Host)
- **Behavioral Indicators:**
- Unauthorized modifications to `~/.zshrc` on macOS.
- Creation of 10-minute interval Launch Agents on macOS.
- Termination of `Alilang.exe` processes on Windows.
## Associated Threat Actors
- **Unknown:** Likely a Chinese-speaking threat actor (based on source code comments and UTC+08:00 timestamped commits) focused on industrial espionage.
## Detection Methods
- **Behavioral Detection:** Monitoring for unusual `curl` or `wget` activity originating from npm `postinstall` scripts or unexpected modifications to shell configuration files.
- **Dependency Analysis:** Auditing `package-lock.json` or `yarn.lock` for unscoped versions of internal private packages.
- **Process Monitoring:** Watching for the termination of security software or VPN clients followed by file replacements in the application directory.
## Mitigation Strategies
- **Scoped Packages:** Use scoped registries for internal packages to prevent dependency confusion attacks.
- **Package Manifest Auditing:** Regularly audit project dependencies for unknown or suspicious maintainers (e.g., "ch4ce").
- **Lockfile Enforcement:** Ensure developers use lockfiles to prevent the accidental pulling of newer, malicious versions of packages.
- **Endpoint Protection:** Use EDR solutions to monitor for unauthorized persistent mechanisms like Launch Agents or shell RC file modifications.
## Related Tools/Techniques
- **Dependency Confusion:** A well-known technique where public repositories are used to shadow internal private package names.
- **Typosquatting:** Registering names similar to popular or existing packages to catch developers making typing errors.