Self-propagating malware poisons open source software and wipes Iran-based machines

A newly identified hacking group has launched an aggressive campaign on the internet, deploying a self-replicating backdoor alongside a data-wiping malware specifically aimed at machines in Iran. This group, known as TeamPCP, first came to light in December when security researchers from Flare observed them unleashing a worm targeting inadequately secured cloud-hosted platforms. The primary goal of TeamPCP is to establish a distributed network for proxy services and scanning, later exploiting compromised servers for data exfiltration, ransomware deployment, extortion, and cryptocurrency mining. The group's expertise lies in large-scale automation and the integration of established attack methodologies. Recently, TeamPCP intensified its operations, employing constantly evolving malware that significantly increases its control over various systems. Last week, they executed a supply-chain attack that compromised nearly all versions of the popular Trivy vulnerability scanner by breaching the GitHub account of Aqua Security, the entity behind Trivy. Over the weekend, researchers noted that TeamPCP was deploying sophisticated malware capable of self-propagation, enabling it to infect new machines without any user interaction. Once a device is compromised, the malware seeks out access tokens for the npm repository and modifies any available publishable packages by injecting malicious code into new versions. Notably, Aikido reported that the worm targeted 28 different packages in a mere 60 seconds. While earlier iterations required manual distribution, the latest updates have automated this process, expanding the worm's reach dramatically. The malware employs a unique, tamper-resistant control mechanism utilizing an Internet Computer Protocol-based canister, which functions as a self-executing smart contract that is impervious to external alterations. This allows the attackers to direct the worm to ever-changing URLs for hosting malicious binaries, enabling continual adjustments to their control infrastructure. Infected machines are designed to report back to the canister every 50 minutes, ensuring the attackers maintain ongoing control.