T1195.001Compromise Software Dependencies and Development Tools
98%
“poisoned ruby gems and go modules exploit ci pipelines for credential theft a new software supply chain attack campaign has been observed using sleeper packages as a conduit to subsequently push malicious payloads that enabled credential theft, github actions tampering, and ssh p…”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1195.001Compromise Software Dependencies and Development Tools
97%
“. " the account is part of a software supply chain campaign targeting developers, ci runners, and build environments across two ecosystems, " socket security researcher kirill boychenko said in an analysis published today. the ruby gems are designed to automate credential theft d…”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1195.001Compromise Software Dependencies and Development Tools
74%
“metrics - sdk - github [. ] com / bufferzonecorp / go - weather - sdk - github [. ] com / bufferzonecorp / go - retryablehttp - github [. ] com / bufferzonecorp / go - stdlib - ext - github [. ] com / bufferzonecorp / grpc - client - github [. ] com / bufferzonecorp / net - helpe…”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1677Poisoned Pipeline Execution
32%
“. " the account is part of a software supply chain campaign targeting developers, ci runners, and build environments across two ecosystems, " socket security researcher kirill boychenko said in an analysis published today. the ruby gems are designed to automate credential theft d…”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
Summary
A new software supply chain attack campaign has been observed using sleeper packages as a conduit to subsequently push malicious payloads that enabled credential theft, GitHub Actions tampering, and SSH persistence.
The activity has been attributed to the GitHub account "BufferZoneCorp," which has published a set of repositories that are associated with malicious Ruby gems and Go modules. As of