Sicherheitsforscher haben manipulierte npm-Pakete entdeckt, die sich als Kalenderwerkzeuge tarnen, jedoch eine Linux-Hintertür installieren.

TrendAI™ Research provides a comprehensive analysis of the RedC2 Linux Implant, a sophisticated threat recently discovered in the npm open-source ecosystem. 

TrendAI™ Research provides a comprehensive analysis of the RedC2 Linux Implant, a sophisticated threat recently discovered in the npm open-source ecosystem.

Trojanized npm packages launch RedC2 4.0 on Linux at import time, giving operators shell access, credential theft, and payload execution.

Un framework di comando e controllo commerciale integra per la prima volta un agente AI che traduce il linguaggio naturale in comandi post-exploitation. Distribuito tramite 14 pacchetti npm trojanizza...

Security researchers have uncovered a supply-chain campaign distributing a native Linux implant tied to RedC2, a commercial multi-OS command-and-control (C2) framework marketed on Hack Forums, through...

Trojanized npm packages launch RedC2 4.0 on Linux at import time, giving operators shell access, credential theft, and payload execution.

Cybersecurity researchers identified 14 trojanized npm packages posing as legitimate calendar and streak utilities, which covertly deploy an AI-powered Linux backdoor named RedC2 4.0. Upon loading, the malicious module extracts a bundled binary, grants it executable permissions, and executes it as a detached background process. The attack targets npm’s package ecosystem, though no specific dates, affected versions, or CVE IDs were disclosed. The RedC2 4.0 implant leverages AI capabilities for command-and-control (C2) operations, though further technical details on its functionality were not provided. The discovery was attributed to Trend Micro’s research team, referenced as TrendAI in the report.

compromised host read more about 14 Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor With AI-Assisted C2

Attackers are increasingly abusing exposed infrastructure, trusted software ecosystems, and AI-assisted tooling, with active exploitation seen against Siemens PLCs, GitLab, PTC Windchill, and trojanized npm packages. Researchers also highlighted fresh techniques and leaks affecting Visa contactless payments, Cloudflare Workers, Unisoc modem firmware, and corporate cloud credentials. #Siemens #S7Series #GitLab #PTCWindchill #RedC2...

セキュリティ研究者らは、Hack Forumsで販売されている商用マルチOS対応C2(コマンド&コントロール)フレームワーク「RedC2」に関連するネイティブLinuxインプラントを配布するサプライチェーン攻撃キャンペーンを発見しました。攻撃には、npmサプライチェーン攻撃として拡大しつつある脅威を象徴する、トロイの

Trojanized npm packages launch RedC2 4.0 on Linux at import time, giving operators shell access, credential theft, and payload execution.

トロイの木馬化されたnpmパッケージ群が、RedC2 4.0のLinuxインプラントを配布しています。これにより攻撃者は、一見無害な依存関係のインポートを足がかりに、SOCKS5プロキシとTCPフォワーディングを通じて内部ネットワークへ侵入する経路を手に入れることになります。 今回のキャンペーンは、実際に機能するカレ

Malicious npm packages are being used to place a Linux backdoor inside calendar and streak-calculation tools. The packages deliver legitimate date functions, making the malicious code easy to miss. The danger begins when an affected module is imported. The loader makes a bundled Linux program executable and starts it in the background, without an install script or suspicious function call. TrendAI researchers identified the campaign as a software supply chain attack that delivers RedShell, the Linux implant associated with the RedC2 command-and-control framework. TrendAI said in a report shared with Cyber Security News (CSN) that it shows how a harmless-looking dependency can become an entry point into a production environment. The impact extends beyond the initial host. The implant can collect credentials, explore a network, move traffic through an infected machine and pull in extra tools. That puts source code, cloud access and internal services at risk when a poisoned package reaches a trusted build chain. Malicious npm Packages Deploy AI-Powered RedC2 Linux Implant The affected packages pose as small, dependency-free utilities for date math. Their advertised features work as expected, while a hidden binary is presented as a native helper. This blend of useful code and concealed execution is why  malicious npm package campaigns  remain difficult for teams to spot early. The entry file,  dist/index.mjs , runs automatically as the module loads. It checks for the binary, changes its permissions and verifies its SHA-256 value before starting it as a detached process. RedC2 advertisement (Source – TrendAI) Since it does not rely on lifecycle hooks, using  --ignore-scripts  does not stop this route to execution. A direct or transitive import can trigger the implant, even if the developer never selected the package. Similar techniques have shown how  configuration file supply chain attacks  can sidestep controls built around familiar npm lifecycle scripts. The binary is RedShell, a native Linux component introduced in RedC2 4.0. The implant uses separate plain HTTP paths for data theft and payload downloads. RedC2 dashboard (Source – TrendAI) The report describes RedShell as capable of taking SSH keys, browser-stored credentials and database-related files. It can create persistence through cron, shell startup files, user-level services or desktop autostart entries. These actions can give intruders a durable foothold after the original package has been removed. AI Assistance Raises the Stakes RedC2 includes Red Agent, a feature that turns a plain-language request into a sequence of commands for an infected system. An operator can ask for reconnaissance or credential collection rather than manually issuing every step. The AI layer can make follow-on activity faster and easier to coordinate. RedShell can run commands, open a reverse shell, transfer files and inspect users, processes and network settings. It supports SOCKS5 proxying, TCP port forwarding and tunnelling, features that can turn one compromised Linux host into a bridge toward otherwise unreachable systems. The risk resembles recent  CI credential theft incidents  in which developer environments provided valuable access beyond one workstation. Security teams should check lockfiles, package caches and build artifacts for the affected package names and versions. RedShell execution flow (Source – TrendAI) Any host that imported one should be treated as potentially compromised: isolate it, rotate exposed credentials, inspect persistence locations and review outbound connections. Removing a dependency alone may not remove a launched implant or undo stolen secrets. Defenders should watch for Node processes changing bundled  .bin  files to executable, unexpected background children from dependency directories, and traffic to the listed addresses and ports. Tightening dependency approval, pinning versions, reviewing package contents and limiting build-system permissions reduce the blast radius. The case reinforces lessons from  cross-platform malware delivery attacks  where native payloads hide behind trusted development tools. For incident response, prioritize hosts with access to source repositories, deployment keys, cloud tokens or production networks. Search endpoint telemetry for the RedShell hash and filenames, block confirmed malicious communications where appropriate, and preserve logs before rebuilding systems. The evidence points to a threat designed to establish a route for network compromise. Indicators of compromise (IoCs):- Type Indicator Description Malicious npm packages streak-metrics-math@1.0.0 ,  streak-metrics-math@1.0.1 Trojanized calendar and streak utility packages delivering the RedShell implant Malicious npm packages kit-map-vim@1.0.0 ,  streak-map-cache@1.0.0 ,  streak-map-kit@1.0.0 ,  map-streak-kit@1.0.0 Identified package variants carrying the malicious Linux payload Malicious npm packages streak-cache-map@1.0.0 ,  streak-calc-metrics@1.0.0 ,  streak-calc-math@1.0.0 ,  streak-math-abz@1.0.0 Identified package variants carrying the malicious Linux payload Malicious npm packages streak-metricsaz@1.0.0 ,  streak-math-metrics@1.0.0 ,  streak-metricazbd@1.0.0 ,  streak-metricsazb@1.0.0 ,  streak-kit-map@1.0.0 Identified package variants carrying the malicious Linux payload SHA-256 4537B1189CE419F1A595CF47216C03F80E9170CE80DAD8D9227A1E52F9CB3466 RedShell Linux implant hash C2 endpoint 217.60.77.63:8792 Primary RedC2 command-and-control server C2 endpoint 127.0.0.1:8792 Fallback command-and-control address Exfiltration endpoint 217.60.77.63:8060 Plain HTTP data exfiltration endpoint Payload endpoint 217.60.77.63:8888 Plain HTTP payload and file download endpoint Domain litterbox.catbox.moe Third-party file-hosting destination used for uploads Domain api.ipify.org Public IP lookup service contacted by the implant File path */dist/internal/calc-cache.bin RedShell payload path identified in hunting guidance File path */dist/math-calc.bin RedShell payload path identified in hunting guidance File path */dist/calc.bin RedShell payload path identified in hunting guidance File path */dist/internal/calc-mapping.bin RedShell payload path identified in hunting guidance File path */dist/math-core.bin RedShell payload path identified in hunting guidance File path */dist/internal/calc-math.dat RedShell payload path identified in hunting guidance Loader file dist/index.mjs Trojanized npm package entry file that launches the bundled implant Persistence file ~/.config/.rsvc Hidden file used to retain the implant installation identifier Note:   IP addresses and domains are intentionally defanged (e.g.,  [.] ) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM . Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs:  Integrate TI Lookup in your SOC The post Malicious npm Packages Deploy AI-Powered RedC2 Linux Implant to Steal Credentials and Pivot Networks appeared first on Cyber Security News .

Een nieuwe aanval op de softwaretoeleveringsketen maakt gebruik van kwaadaardige npm-pakketten die zich voordoen als nuttige hulpprogramma's voor datum-berekeningen. Deze pakketten introduceren een Linux-backdoor, genaamd RedShell, die deel uitmaakt van het RedC2 command-and-control framework. De kwaadaardige code wordt eenvoudig gemist omdat de pakketten, die afhankelijkheid-vrij zijn en zich gedragen als legitieme datumhulpprogramma's, geen verdachte functieaanroepen of installatiescripts gebruiken. Wanneer een getroffen module wordt geïmporteerd, wordt het verborgen Linux-programma (`dist/index.mjs`) automatisch uitgevoerd. Dit programma wijzigt de permissies van het binaire bestand, ver...