Full Report
A threat actor uploaded malicious packages to the Arch User Repository (AUR) that impersonated two popular helper tools, yay and paru. [...]
Analysis Summary
# Tool/Technique: Typosquatted AUR Trojan (DirtyBlanket Variant)
## Overview
This technique involves the distribution of malware via the Arch User Repository (AUR) using typosquatted package names that impersonate popular AUR helpers like `yay` and `paru`. The attack leverages the community-driven nature of the AUR to trick users into executing malicious installation scripts (`PKGBUILD` or `.install` files) that fetch and execute second-stage payloads with root privileges.
## Technical Details
- **Type:** Malware / Supply Chain Attack
- **Platform:** Linux (specifically Arch Linux and derivative distributions)
- **Capabilities:** Remote script execution, privilege escalation (root), persistent access via remote shell, and potential delivery of Remote Access Trojans (RATs).
- **First Seen:** October 13, 2026 (Recent campaign); related activity traced back to June/July 2026.
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain
- **TA0002 - Execution**
- T1059.004 - Command and Scripting Interpreter: Unix Shell
- T1072 - Software Deployment Tools
- **TA0004 - Privilege Escalation**
- T1548 - Abuse Elevation Control Mechanism (Executing via AUR install scripts often grants root perms)
- **TA0011 - Command and Control**
- T1105 - Ingress Tool Transfer
## Functionality
### Core Capabilities
- **Typosquatting:** Uses names like `yyay` to impersonate legitimate tools (`yay`).
- **Trojanized Packaging:** Repackages legitimate upstream source code with a malicious installation scriptlet.
- **Root Execution:** Exploits the installation process of AUR packages, which typically requires or prompts for sudo privileges, to execute scripts as the root user.
- **Remote Payload Fetching:** Uses `curl` or `wget` within install scripts to download second-stage shell scripts from external repositories.
### Advanced Features
- **Archive Obfuscation:** Uses the Wayback Machine (archive.org) to proxy requests to malicious repositories, potentially bypassing simple domain-based reputation filters.
- **Cross-Platform Infrastructure:** Links to repositories on GitFlic (Russian hosting) and Codeberg, indicating a diversified infrastructure for payload hosting.
## Indicators of Compromise
- **File Names:** `yyay`, `paru-git` (malicious variants), `install-scripts`
- **Network Indicators:**
- `web[.]archive[.]org/web/[ID]/https://gitflic[.]ru/project/hellscripter/install-scripts/`
- `codeberg[.]org/hellscripter/install-scripts`
- `gitflic[.]ru`
- **Behavioral Indicators:**
- Unexpected network connections during the `makepkg` or installation phase of an AUR package.
- Presence of unauthorized remote shells or new systemd services disguised as system components (e.g., "font service").
- Modification of `/etc/sudoers` or unauthorized SSH key additions.
## Associated Threat Actors
- **marchos1as** (AUR account name used in this campaign)
- **hellscripter** (Identifier used across GitFlic and Codeberg)
- **DirtyBlanket Campaign** (Potential link via npm-based Linux worm activity)
## Detection Methods
- **Signature-based detection:** Scanning `PKGBUILD` files for suspicious `curl | bash` or `wget | sh` patterns.
- **Behavioral detection:** Monitoring for unexpected child processes of package managers (e.g., `pacman` or `makepkg`) initiating outbound network connections to non-upstream domains.
- **Tooling:** Use of specialized AUR security scanners like **TrustSight** to detect anomalies in package build scripts.
## Mitigation Strategies
- **Manual Code Review:** Always inspect `PKGBUILD` and `.install` files from the AUR before building/installing (e.g., using `yay -P` or manual inspection).
- **Verify Maintainer:** Check the reputation and history of the package maintainer on the AUR website.
- **Principle of Least Privilege:** Avoid running AUR helpers as root; use tools that support building in a clean chroot environment.
- **System Auditing:** Implement `auditd` to monitor execution of sensitive commands during software installation.
## Related Tools/Techniques
- **CHAOS RAT:** A remote access trojan previously linked to the same infrastructure.
- **Typosquatting:** Common technique used in npm, PyPI, and Crates.io attacks.
- **AUR Helpers:** Legitimate tools being impersonated (`yay`, `paru`, `trizen`).