Turnkey Rootkit for Amateur Hackers Makes Supply Chain Attacks EasyTurnkey Rootkit for Amateur Hackers Makes Supply Chain Attacks Easy
It's never been easier to hide malware in plain sight in open source software package repositories, and "DiscordRAT 2.0" now makes it easy to take advantage of those who stumble upon it.
October 4, 2023
Researchers have discovered a typosquatting npm package concealing a full-service Discord remote access Trojan (RAT) that offers rootkit functionality. The malware, dubbed "DiscordRAT 2.0," functions as a turnkey hacking tool that's perfect for newbies, and it lowers the barrier to entry for pulling off open source software supply chain attacks.
In this case, the package — "node-hide-console-windows" — was made to closely resemble a legitimate package, node-hide-console-window, a simple module for toggling an app's console window visibility, which is downloaded 300 or so times every week. The malicious npm entry was made to look nearly identical to the original's, including uploading 10 separate versions to match the original's count.
The ruse worked: The copycat with an added "s" was downloaded around 700 times before being taken down.
"Open source has many, many benefits, and I think the benefits far outweigh the drawbacks," says Ashlee Bengee, ReversingLabs' director of threat intelligence advocacy. "But having that kind of software out there allows for this malicious behavior to be hidden very easily."
A Fake Package Hiding a Real RootkitWhen ReversingLabs researchers first came upon the copycat package — suspiciously uploaded on Aug. 25 by a new account and not connected to any other npm projects — they discovered unobfuscated malicious code inside of its "index.js" file. Upon running, the malicious file downloaded an executable file: a copy of DiscordRAT 2.0.DiscordRAT 2.0 is a compact, C#-based remote hacking tool. According to its GitHub page, it's meant "for educational use only," though the sincerity in that sentiment is in question."A lot of these are released under the guise of being for educational purposes, and they do have that function, I suppose, which is good for defenders. But at the same time, it's also really easy for anyone with very minimal knowledge to go and download malware that's freely available on something like GitHub. And it's very easy to launch an email campaign with that malware just attached directly," Bengee points out.Crucially, users of DiscordRAT 2.0 manage their victims with little expertise required, via individual Discord channels. The tool provides them with dozens of easy-to-use commands for stealing credentials, manipulating files, killing processes, or even bluescreening a host computer.Most notable of all, however, is its command, "!rootkit."
Hacking Made Accessible and Easy
The !rootkit function within DiscordRAT 2.0 triggers the execution of a second open source malware, the r77 rootkit.
The code is a "rootkit that hides everything" — TCP and UDP connections, files and directories, processes and CPU usage, and more — according to its GitHub page. Any hacker with administrative privileges can use it to stealthily establish persistence on a host, perform malicious activities, and access highly privileged data — without a lot of know-how.
That an open source, full-service, turnkey RAT packs this kind of punch signals just how little expertise even hackers have to have, and how little effort they need to put in, in order to perform even relatively sophisticated attacks.
"It's just really opened the doors for would-be attackers," Bengee says, "especially because this has become such an easy way to make a quick buck."
About the Author(s)
You May Also Like
Hacking Your Digital Identity: How Cybercriminals Can and Will Get Around Your Authentication MethodsOct 26, 2023
Modern Supply Chain Security: Integrated, Interconnected, and Context-DrivenNov 06, 2023
How to Combat the Latest Cloud Security ThreatsNov 06, 2023
Reducing Cyber Risk in Enterprise Email Systems: It's Not Just Spam and PhishingNov 01, 2023
SecOps & DevSecOps in the CloudNov 06, 2023
9 Traits You Need to Succeed as a Cybersecurity Leader
The Ultimate Guide to the CISSP
Quantifying the Gap Between Perceived Security and Comprehensive MITRE ATT&CK Coverage
Building Immunity: The 2021 Healthcare and Pharmaceutical Industry Cyber Threat Landscape Report
Managed Security and the 3rd Party Cyber Risk Opportunity Whitepaper