Malicious bee-js and Swarm Desktop releases steal node wallet keys
Original title: Hackers Compromise Ethersphere's bee-js and Swarm Desktop to Deliver Wallet-Stealing Malware
Stolen CI credentials published bee-js 13.3.0 and Swarm Desktop 0.56.2; both were withdrawn, and 0.56.3 is a clean rebuild.
Attackers used Ethersphere's release automation to publish bee-js 13.3.0 and Swarm Desktop 0.56.2, which download code that steals the Swarm node key and its plaintext password and installs a backdoor on Windows, macOS, and Linux. Both releases were withdrawn. Maintainers say 0.56.2 was published with stolen CI credentials and replaced by signed 0.56.3. No theft of funds had been reported at the time of writing.
Unconfirmed: No count of infected machines was given, and no theft of funds had been reported at the time of writing.
- bee-js 13.3.0 was the latest npm version for about 75 minutes and ran as a postinstall script.
- Swarm Desktop 0.56.2 was on GitHub about 8.5 hours; download count reached 65, including researchers.
- Socket estimates bee-js 13.3.0 was downloaded about 10 times, including scanners and mirrors.
- Linux and macOS backdoor is evjawbreaker; Windows installs a ScreenConnect Client service.
Impact: node wallet keys, passwords, and a persistent backdoor
| Product | Affected | Fixed in |
|---|---|---|
| Ethersphere bee-js | 13.3.0 | 13.2.0 |
| Ethersphere Swarm Desktop | 0.56.2 | 0.56.3 |
- 1.Search lockfiles and caches for @ethersphere/bee-js@13.3.0 and pin 13.2.0.
- 2.If 0.56.2 ran, move node funds, chequebook, and stake to a new key from a clean computer.
- 3.Remove ~/.solidity, the langsupport service or LaunchAgent, and the named ScreenConnect service.
- ATT&CK
- T1195.002 Compromise Software Supply ChainT1555 Credentials from Password StoresT1543 Create or Modify System Process
- Vendors
- Ethersphere
- Products
- bee-jsSwarm Desktopswarm-cli
- Malware
- evjawbreaker
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | frameworkmetrics.xyz | It is a few lines of code that download more code from api.frameworkmetrics[.]xyz and run it with the user's permissions. In bee-js the loa |
| ipv4 | 185.232.84.169 | .]57[.]9[.]155:4912 (evjawbreaker control server) IP:port : 185[.]232[.]84[.]169:8041 (ScreenConnect relay) Ethereum contract : 0xf8a9 |
| ipv4 | 193.57.9.155 | olen wallet files) HTTP header : X-Ethersphere: 1 IP:port : 193[.]57[.]9[.]155:4912 (evjawbreaker control server) IP:port : 185[.]23 |
| sha256 | 37d14bff30762ca701e9c1f8bc6c57c065bb20ae3a2208cb7411a6530610f08e | 08af2e245d81003237875415930fd27358 (darwin_arm64) SHA-256 : 37d14bff30762ca701e9c1f8bc6c57c065bb20ae3a2208cb7411a6530610f08e (invoke.ps1) SHA-256 : 7527e86d70e7c9493db4356f1c3775380431 |
| sha256 | 7527e86d70e7c9493db4356f1c3775380431b310000f2602c1e993cf435d01da | 57c065bb20ae3a2208cb7411a6530610f08e (invoke.ps1) SHA-256 : 7527e86d70e7c9493db4356f1c3775380431b310000f2602c1e993cf435d01da (app.msi) Found this article interesting? Follow us on Goog |
| sha256 | 80d2672e2599732d3c0ae2a4cd0d1e3fe4d555a60273ce33feb99db3f34d250f | 8a122d5247a35a77a64b04f286e1bbcc565 (linux_arm64) SHA-256 : 80d2672e2599732d3c0ae2a4cd0d1e3fe4d555a60273ce33feb99db3f34d250f (darwin_amd64) SHA-256 : fae61f31f00988fdc5cc9e7272b51e08af |
| sha256 | 9b73e7cd4e1425e770392549d8df46c706139ef476f4f7b9ac405165dc8d9696 | Service : ScreenConnect Client (5cbe79c9c25524df) SHA-256 : 9b73e7cd4e1425e770392549d8df46c706139ef476f4f7b9ac405165dc8d9696 (linux_amd64) SHA-256 : b601776817363b96295119f7221338a122d |
| sha256 | b601776817363b96295119f7221338a122d5247a35a77a64b04f286e1bbcc565 | 6c706139ef476f4f7b9ac405165dc8d9696 (linux_amd64) SHA-256 : b601776817363b96295119f7221338a122d5247a35a77a64b04f286e1bbcc565 (linux_arm64) SHA-256 : 80d2672e2599732d3c0ae2a4cd0d1e3fe4d |
| sha256 | fae61f31f00988fdc5cc9e7272b51e08af2e245d81003237875415930fd27358 | 3fe4d555a60273ce33feb99db3f34d250f (darwin_amd64) SHA-256 : fae61f31f00988fdc5cc9e7272b51e08af2e245d81003237875415930fd27358 (darwin_arm64) SHA-256 : 37d14bff30762ca701e9c1f8bc6c57c065 |
From the original article
6 min read at thehackernews.com
Attackers used the Ethersphere project's own release automation to publish malicious versions of two of its tools for the Swarm decentralized storage network: bee-js 13. 3. 0 and Swarm Desktop 0.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.