Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
8 IOCs
ChainDrop supply chain compromise: Anatomy of a self-propagating worm
Excerpt
In this article Attack chain overview Mitigation and protection guidance Indicators of compromise (IOC) Microsoft Defender XDR detections Advanced hunting queries Learn more Microsoft Threat Intelligence identified a large-scale npm supply chain attack affecting more than 400 packages across multiple unrelated publishers, including packages associated with major enterprise software ecosystems such as keyv, flat-cache, cache-manager, and others. The malicious releases contain…
Read the original report →Diamond Model
Adversary
Infrastructure(4)
Capability
Victim
Indicators of Compromise
Open the mindmap →8 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | npm-cache.com | High | Score 86/100 | First seen |
| Domain | js-mirror.com | High | Score 86/100 | First seen |
| SHA256 | 54dc7ea54a1317cca0e890a2770630cf7fa6c97813e0cb9d2caa93012b350668 | High | Score 59/100 | First seen |
| URL | https://npm-cache.com:443/router | High | Score 58/100 | First seen |
| SHA1 | e1f2395ee43e45a1556ec6438a88c31b83493103 | Medium | Score 53/100 | First seen |
| SHA256 | fd3ca4007b225fdf8de7af4345a19179d5efa8c4bb9205f88cda806e5684b1eb | High | Score 62/100 | First seen |
| SHA256 | 9fc2570b7cef51c1b8df116d144d11ff4096357be7d2c4c6367cfc2509cf1bcc | High | Score 62/100 | First seen |
| Domain | pypi-get.com | High | Score 86/100 | First seen |
IOC Relationship Graph
Building graph…