Malware

CageyChameleon

Also known as: Cabbage RAT

CageyChameleon Malware is a VBS-based backdoor which has the capability to enumerate the list of running processes and check for the presence of several antivirus products. CageyChameleon will collect user host information, system current process information, etc. The collected information is sent back to the C2 server, and continue to initiate requests to perform subsequent operations.

Indicators of Compromise 6

Domain npmjs[.]store Filename core.js SHA-256 2014d09c7ded74d89c885b5f11693865224116f1b25df9330e61fe528f419d73 SHA-256 24604384b0e748ada07923630b3d037489e696284a98c4409fb9b6763565571f IP 216[.]74[.]123[.]126 Package typo-crypto

MITRE ATT&CK TTPs 7

Obfuscated Files or Information

Defense Evasion

Command And Control

Acquire Infrastructure

Resource Development

Deploy Container

Defense Evasion

Source Articles

Amazon identifies North Korean hacker group behind open-source supply chain attacks | AWS Security Blog

Amazon Threat Intelligence has identified a DPRK-linked threat actor behind multiple supply chain attacks on popular NPM packages including axios, debug, chalk, and typo-crypto. The actor used social engineering to gain access to maintainer accounts and published trojanized updates containing malicious code. These attacks leveraged post-install hooks, multi-stage payloads, and C2 infrastructure to deliver malware across thousands of downstream environments. The same actor is assessed to have tested their tradecraft in a smaller campaign via the typo-crypto package before escalating to higher-impact compromises. The group uses sophisticated evasion techniques including code obfuscation, environment detection to avoid sandboxes, and generative AI to produce convincing malicious packages.