Introduction:
In a recent cyber threat development, Python developers are under attack through a typosquatting campaign aimed at PyPI packages. This malicious activity poses a significant risk to the integrity and security of Python libraries, impacting developers worldwide.
Topic: Typosquatting Campaign Targeting Python Developers on PyPI
- Understanding Typosquatting
- Definition and Mechanisms
- Risks Posed by Typosquatting
- PyPI as a Target
- Importance of PyPI in Python Development
- Vulnerabilities Exploited by Typosquatting
- Modus Operandi of the Campaign
- Techniques Employed by Attackers
- Scope and Scale of the Campaign
- Implications for Developers and Users
- Risks to Code Integrity and Security
- Potential Impact on Development Workflow
Conclusion:
The recent typosquatting campaign striking Python developers through PyPI packages underscores the ever-evolving landscape of cyber threats. Developers and users must remain vigilant, implementing robust security measures to mitigate such risks and safeguard the integrity of their codebase.
Suggestion:
To mitigate the risk posed by typosquatting campaigns targeting PyPI packages, developers are advised to:
- Double-check package names and sources before installation.
- Utilize package verification mechanisms provided by PyPI.
- Stay informed about emerging threats and security best practices in software development.
Source: Blog Post
Source Reliability: Trustworthy
Information Reliability: Confirmed
Motivation: Cyber Crime
Source Category: Technical Intelligence
Severity: Low
IOC Information:
| IOC Type | IOC | Malicious Info |
|---|---|---|
| Hash | 62ad0407a9cce34afb428dee972292d2aa23c78cbc1a44627cb2e8b945195bc2 | Kaspersky information not available |
| Hash | f927cd4f40c7a6dad769a8f9af771a8c | Malicious: 33, Malware Family: multi, Metadefender Percentage: N/A, Blocked Reason: N/A, Zone: Red, HitsCount: 100 |
| Hash | 0fdfef7c9cc4305df81b006e898e1592aa822437 | Malicious: 33, Malware Family: multi, Metadefender Percentage: N/A, Blocked Reason: N/A, Zone: Red, HitsCount: 100 |
| Hash | 06bbb36baf63bc5cb14d7f097745955a4854a62fa3acef4d80c61b4fa002c542 | Malicious: 33, Malware Family: multi, Metadefender Percentage: N/A, Blocked Reason: N/A, Zone: Red, HitsCount: 100 |
| Hash | 5f4d630ef00656726401b205ae4dc88f | Malicious: 30, Malware Family: N/A, Metadefender Percentage: 100, Blocked Reason: , Zone: Red, HitsCount: 10 |
| Hash | 76a1f94ed6499b99d2cc500998846875 | Malicious: 49, Malware Family: cobalt, Metadefender Percentage: 100, Blocked Reason: File is infected, see description, Zone: Red, HitsCount: 100 |
| Hash | 8800e6f1501f69a0a04ce709e9fa251c | Malicious: 61, Malware Family: heur, Metadefender Percentage: 100, Blocked Reason: File is infected, see description, Zone: Red, HitsCount: 100 |
| Hash | a59a7916156c52f732b4c2e321facfe1 | Kaspersky information not available |
| Hash | b1f5e4774aa79f643350218df61e33f6 | Kaspersky information not available |
| Hash | c561c2cdad206b6ed8469079e037e3f9 | Kaspersky information not available |
| Hash | d1da347e78bf043e2dc61638e946c3da | Malicious: 47, Malware Family: N/A, Metadefender Percentage: 100, Blocked Reason: , Zone: Red, HitsCount: 1000 |
| Hash | 72a1c9ea93d18309769d8be5cdb3daedf1cddcf5 | Malicious: 61, Malware Family: heur, Metadefender Percentage: 100, Blocked Reason: File is infected, see description, Zone: Red, HitsCount: 100 |
| Hash | 8c949a7769d16c285347f650ef2eedac01dc1805 | Kaspersky information not available |
| Hash | aa8f2d6d98aa535e05685076ca02f781c2aa6464 | Malicious: 30, Malware Family: N/A, Metadefender Percentage: 100, Blocked Reason: , Zone: Red, HitsCount: 10 |
| Hash | ca14d61bcf038cda45199f54c7c452ad262a7c88 | Malicious: 49, Malware Family: cobalt, Metadefender Percentage: 100, Blocked Reason: File is infected, see description, Zone: Red, HitsCount: 100 |
| Hash | d87a3c22771b1106a1a52d96df7b2944d93fa184 | Malicious: 47, Malware Family: N/A, Metadefender Percentage: 100, Blocked Reason: , Zone: Red, HitsCount: 1000 |
| Hash | f1e7994c6568f0182a60f64557c7793df5e550ed | Kaspersky information not available |
| Hash | 1ab812f7d829444dc703eeb02ea0a955ec839d5e2a9b619d44ac09a91135cad1 | Malicious: 47, Malware Family: N/A, Metadefender Percentage: 100, Blocked Reason: , Zone: Red, HitsCount: 1000 |
| Hash | 3c9f4145e310f616bd5e36ca177a3f370edc13cf2d54bb87fe99972ecf3f09b4 | Malicious: 61, Malware Family: heur, Metadefender Percentage: 100, Blocked Reason: File is infected, see description, Zone: Red, HitsCount: 100 |
| Hash | 9c337d27dab65fc3f4b88666338e13416f218ab75c4b5e37cc396241c225efe8 | Malicious: 30, Malware Family: N/A, Metadefender Percentage: 100, Blocked Reason: , Zone: Red, HitsCount: 10 |
| Hash | b378c2aa759625de2ad1be2c4045381d7474b82df7eb47842dc194bb9a134f76 | Kaspersky information not available |
| Hash | d6127d614309acbf2a630fe3fb0fda8e4079dcf2045f91aa400d179751d425f7 | Malicious: 49, Malware Family: cobalt, Metadefender Percentage: 100, Blocked Reason: File is infected, see description, Zone: Red, HitsCount: 100 |
| Hash | eae2bce6341ff7059b9382bfa0e0daa337ea9948dd729c0c1e1ee9c11c1c0068 | Kaspersky information not available |
| IP | 162.33.178.40 | Malicious: 6, Suspicious: 0, Zone: Grey, Abuse Score: 0 |
| IP | 174.138.188.6 | Malicious: 1, Suspicious: 0, Zone: Orange, Abuse Score: 0 |
| IP | 185.29.9.162 | Malicious: 0, Suspicious: 0, Zone: Grey, Abuse Score: 0 |
| IP | 193.149.129.131 | Malicious: 4, Suspicious: 0, Zone: Grey, Abuse Score: 0 |
| IP | 45.155.204.5 | Malicious: 2, Suspicious: 0, Zone: Grey, Abuse Score: 0 |
| IP | 45.61.139.206 | Malicious: 0, Suspicious: 0, Zone: Grey, Abuse Score: 0 |
| IP | 5.255.102.167 | Malicious: 7, Suspicious: 0, Zone: Grey, Abuse Score: 0 |
| IP | 5.255.105.55 | Malicious: 2, Suspicious: 0, Zone: Grey, Abuse Score: 0 |
| IP | 91.215.85.183 | Malicious: 16, Suspicious: 0, Zone: Red, Abuse Score: 0 |
| URL | http://152.89.196.49:61384 | Malicious: 13, Suspicious: 0, K Zone: Redip |
| URL | https://funcaptcha.ru/app.asar | Malicious: 6, Suspicious: 0, K Zone: Red |
| URL | https://funcaptcha.ru/atomic/app.asar | Malicious: 17, Suspicious: 2, K Zone: Red |
| URL | https://funcaptcha.ru/delivery | Malicious: 15, Suspicious: 0, K Zone: Red |
| URL | https://funcaptcha.ru/hvnc.py | Malicious: 2, Suspicious: 0, K Zone: Red |
| URL | https://funcaptcha.ru/paste2?package=insanepackagev1414 | Not Found |
| Domain | funcaptcha.ru | Malicious: 18, Suspicious: 1, Status: Red |
| Domain | install.run | Malicious: 0, Suspicious: 0, Status: Green |
| Domain | requests.post | Malicious: 0, Suspicious: 0, Status: Grey |
| Domain | subprocess.run | Malicious: 3, Suspicious: 0, Status: Green |
| [email protected] | – |
