Chinese-backed hacker group UNC53 has infected at least 29 global organizations with a decade-old strain of Sogu malware, delivered via USB drives. The malware, also known as Korplug or PlugX, has been detected in organizations across the United States, Europe, and Asia, with many infections originating from Africa-based operations. The malware has been found to spread via shared computers in print shops and internet cafés.

Impact: The Sogu malware campaign represents a revival of USB-based hacking, which can compromise both internet-connected and air-gapped systems. The malware copies itself onto any USB drive inserted into the infected PC, and if on an air-gapped computer, it attempts to connect to local networks or stores stolen data on the infected USB drive until it can be transferred to an internet-connected machine.

Recommendation: Organizations should enforce strict policies regarding the use of external drives, shared computers, and public internet or internet cafes. Public internet use can be avoided by tethering to company mobile devices instead. Limit access to company resources from unknown or untrusted IPs. Consider implementing network segmentation to limit the spread of malware and educate employees about the risks of using public computers and USB drives.

Cybersecurity researchers have uncovered a new threat within the npm package registry, where 14 malicious npm packages were identified. These packages, including @am-fe/hooks, @expue/app, and others, initially appear as legitimate JavaScript libraries and components. However, once installed, they execute obfuscated code designed to collect and siphon sensitive files from compromised systems, including Kubernetes configurations and SSH keys.

Impact: Along with Kubernetes config and SSH keys, these packages are also capable of collecting system metadata such as usernames, IP addresses, and hostnames. This data is transmitted to a malicious domain named app.threatest[.]com. This discovery follows recent incidents of counterfeit npm packages exploiting dependency confusion and targeting open-source registries, highlighting the continued risk to the software supply-chain and developer environments.

Recommendation: To defend against these threats, users and organizations must adopt rigorous security practices when dealing with npm packages. Only source packages from trusted and reputable developers or repositories, and vigilantly monitor package dependencies for unusual or suspicious changes. Employ robust security solutions to scan packages for potential malicious code. Additionally, developers and teams should be well-informed about supply-chain attack risks and maintain awareness of emerging threats and vulnerabilities within the open-source ecosystem. Proactive measures are essential to mitigating these evolving threats effectively.