Follow
Detection stack
- AIDR
- Alert
- ETL
- Query
Summary
Red Asgard reported a supply-chain compromise tied to a cryptocurrency project promoted via Upwork, where Lazarus operators embedded malicious code into the build/workflow. The chain abuses VSCode task auto-execution, a Node.js backdoor implemented through the Function constructor, and cookie-gated payload delivery to fetch malicious JavaScript from Vercel-hosted command-and-control infrastructure. The C2 stack is split into stage-one Vercel domains and stage-two dedicated Windows servers, which deliver a heavily obfuscated Python backdoor with XMRig mining functionality. The campaign also uses Pastebin dead drops, a custom binary protocol, and strict credential compartmentalization to complicate analysis and takedown.
Investigation
The researchers enumerated three Vercel domains exposing token-authenticated endpoints and identified five dedicated C2 systems running Express.js on port 1244. They also documented a timing-oracle technique used to infer or enumerate active campaign tokens. Reverse engineering of a 64-layer obfuscated payload ultimately revealed a trojanized component that persists via Startup folder placement and scheduled task creation. Additional findings included hard-coded MongoDB credentials, approximately 1,000 Pastebin dead-drop URLs, and custom Z238 binary protocol listeners on multiple ports.
Mitigation
Block outbound communications to the identified Vercel domains and restrict egress to ports 1244, 1249, and 22411–22412. Monitor for creation of Windows Update Script.pyw in Startup locations, scheduled tasks named “Runtime Broker”, and suspicious msedge.exe execution consistent with miner masquerading. Detect Node.js processes invoking Function.constructor and anomalous HTTP POST activity to /keys endpoints. Reduce exposure by disabling VSCode auto-run tasks and reviewing package scripts prior to executing npm install or running build steps in untrusted repositories.
Response
If indicators are observed, isolate the affected system, terminate suspicious processes, and preserve memory and disk artifacts for forensic review. Revoke any exposed MongoDB credentials and rotate all relevant service-account secrets. Perform an account and access inventory to identify impacted users, then reset credentials and invalidate active sessions/tokens. Notify internal stakeholders and coordinate with law enforcement if there is evidence of cryptocurrency theft or wallet compromise.
"graph TB %% Class definitions classDef technique fill:#cce5ff classDef artifact fill:#e2f7d6 %% Step 1 u2013 Phishing via Service tech_phishing["<b>Technique</b> – <b>T1566.003 Phishing: Spearphishing via Service</b><br/><b>Description</b>: Attacker impersonated a freelancer on Upwork and posted a fake job interview to deliver a malicious code repository."] class tech_phishing technique artifact_upwork["<b>Artifact</b> – <b>Name</b>: Fake Upwork Job Posting<br/><b>Purpose</b>: Lure victim to download malicious repository."] class artifact_upwork artifact tech_phishing –>|delivers| artifact_upwork %% Step 2 u2013 Supply Chain Compromise tech_supplychain["<b>Technique</b> – <b>T1195.001 Supply Chain Compromise: Compromise Software Dependencies and Development Tools</b><br/><b>Description</b>: Malicious VSCode <code>tasks.json</code> and JavaScript code injected into the repository."] class tech_supplychain technique artifact_tasksjson["<b>Artifact</b> – <b>Name</b>: VSCode <code>tasks.json</code><br/><b>Content</b>: Malicious Task definition invoking JavaScript Function constructor and <code>getCookie()</code>."] class artifact_tasksjson artifact artifact_upwork –>|contains| artifact_tasksjson artifact_tasksjson –>|enables| tech_supplychain %% Step 3 u2013 User Execution tech_userexec["<b>Technique</b> – <b>T1204.002 User Execution: Malicious File</b><br/><b>Description</b>: Victim opened the project folder in VSCode, triggering the autou2011execution of the malicious tasks."] class tech_userexec technique artifact_tasksjson –>|triggered by| tech_userexec %% Step 4 u2013 JavaScript Execution tech_jsexec["<b>Technique</b> – <b>T1059.007 Command and Scripting Interpreter: JavaScript</b><br/><b>Description</b>: JavaScript executed via VSCode tasks and Function constructor to download additional payloads."] class tech_jsexec technique tech_userexec –>|leads to| tech_jsexec %% Step 5 u2013 Python Backdoor tech_python["<b>Technique</b> – <b>T1059.006 Command and Scripting Interpreter: Python</b><br/><b>Description</b>: Heavily obfuscated Python backdoor (<code>bro_*.js</code>) downloaded and executed on the victim host."] class tech_python technique artifact_python_backdoor["<b>Artifact</b> – <b>Name</b>: Obfuscated Python Backdoor (<code>bro_*.js</code>)<br/><b>Characteristics</b>: Multiu2011layered encoding and decoding."] class artifact_python_backdoor artifact tech_jsexec –>|downloads| artifact_python_backdoor artifact_python_backdoor –>|executes| tech_python %% Step 6 u2013 Startup Persistence tech_startup["<b>Technique</b> – <b>T1037.005 Boot or Logon Initialization Scripts: Startup Items</b><br/><b>Description</b>: Persistence via placing <code>Windows Update Script.pyw</code> in the Startup folder."] class tech_startup technique artifact_startup_script["<b>Artifact</b> – <b>Name</b>: <code>Windows Update Script.pyw</code><br/><b>Location</b>: Startup folder"] class artifact_startup_script artifact tech_python –>|creates| artifact_startup_script artifact_startup_script –>|enables| tech_startup %% Step 7 u2013 Scheduled Task tech_schedtask["<b>Technique</b> – <b>T1053 Scheduled Task/Job</b><br/><b>Description</b>: Scheduled task named u201cRuntime Brokeru201d created to run at logon."] class tech_schedtask technique artifact_schedtask["<b>Artifact</b> – <b>Name</b>: Scheduled Task u201cRuntime Brokeru201d<br/><b>Trigger</b>: At user logon"] class artifact_schedtask artifact tech_startup –>|adds| artifact_schedtask artifact_schedtask –>|executes| tech_schedtask %% Step 8 u2013 Credential Harvesting from Browsers tech_credbrowser["<b>Technique</b> – <b>T1555.003 Credentials from Password Stores: Credentials from Web Browsers</b><br/><b>Description</b>: Malware harvested browser profile data and stored credentials."] class tech_credbrowser technique artifact_browser_data["<b>Artifact</b> – <b>Data</b>: Extracted browser passwords and cookies"] class artifact_browser_data artifact tech_schedtask –>|collects| tech_credbrowser tech_credbrowser –>|stores| artifact_browser_data %% Step 9 u2013 Steal Web Session Cookie tech_stealcookie["<b>Technique</b> – <b>T1539 Steal Web Session Cookie</b><br/><b>Description</b>: <code>getCookie()</code> function retrieved session cookies from the victimu2019s browser."] class tech_stealcookie technique artifact_getcookie["<b>Artifact</b> – <b>Data</b>: Session cookies captured from browsers"] class artifact_getcookie artifact tech_credbrowser –>|enables| tech_stealcookie tech_stealcookie –>|produces| artifact_getcookie %% Step 10 u2013 Use Alternate Authentication Material tech_altauth["<b>Technique</b> – <b>T1550.004 Use Alternate Authentication Material: Web Session Cookie</b><br/><b>Description</b>: Harvested cookies later used to hijack authenticated web sessions."] class tech_altauth technique artifact_getcookie –>|used by| tech_altauth %% Step 11 u2013 Masquerading tech_masquerade["<b>Technique</b> – <b>T1036.003 Masquerading: Rename Legitimate Utilities</b><br/><b>Description</b>: Malicious binaries renamed to u201cRuntime Broker.exeu201d and u201cmsedge.exeu201d."] class tech_masquerade technique artifact_renamed_bins["<b>Artifact</b> – <b>Files</b>: <code>Runtime Broker.exe</code>, <code>msedge.exe</code> (malicious)"] class artifact_renamed_bins artifact tech_altauth –>|delivers| artifact_renamed_bins artifact_renamed_bins –>|used in| tech_masquerade %% Step 12 u2013 Impair Defenses tech_impairdefense["<b>Technique</b> – <b>T1562 Impair Defenses</b><br/><b>Description</b>: Added Windows Defender exclusions via PowerShell to evade detection."] class tech_impairdefense technique artifact_defender_exclusion["<b>Artifact</b> – <b>Command</b>: PowerShell script adding Defender exclusion paths"] class artifact_defender_exclusion artifact tech_masquerade –>|executes| artifact_defender_exclusion artifact_defender_exclusion –>|enables| tech_impairdefense %% Step 13 u2013 Obfuscated Files tech_obfuscation["<b>Technique</b> – <b>T1027 Obfuscated Files or Information</b><br/><b>Description</b>: Payload employed 64 nested obfuscation layers (Base85, XOR, zlib, reversed Base64)."] class tech_obfuscation technique tech_impairdefense –>|protects| tech_obfuscation %% Step 14 u2013 Hide Artifacts tech_hideartifacts["<b>Technique</b> – <b>T1564.012 Hide Artifacts: File/Path Exclusions</b><br/><b>Description</b>: Defender exclusions and hidden files used to conceal malicious artifacts."] class tech_hideartifacts technique tech_obfuscation –>|facilitates| tech_hideartifacts %% Step 15 u2013 Deadu2011Drop Resolver tech_dead_drop["<b>Technique</b> – <b>T1102.001 Web Service: Dead Drop Resolver</b><br/><b>Description</b>: Malware fetched commands from a network of ~1,000 deadu2011drop Pastebin accounts."] class tech_dead_drop technique artifact_pastebin["<b>Artifact</b> – <b>Service</b>: Pastebin deadu2011drop resolver accounts"] class artifact_pastebin artifact tech_hideartifacts –>|retrieves| artifact_pastebin artifact_pastebin –>|provides commands to| tech_dead_drop %% Step 16 u2013 Exfiltration Over FTP tech_exfilftp["<b>Technique</b> – <b>T1048.003 Exfiltration Over Alternative Protocol: Unencrypted Nonu2011C2 Protocol</b><br/><b>Description</b>: Collected data exfiltrated via FTP on port 21."] class tech_exfilftp technique artifact_ftp["<b>Artifact</b> – <b>Protocol</b>: FTP (port 21) used for data transfer"] class artifact_ftp artifact tech_dead_drop –>|sends data via| tech_exfilftp tech_exfilftp –>|uses| artifact_ftp %% Step 17 u2013 Resource Hijacking (Monero Mining) tech_resourcehijack["<b>Technique</b> – <b>T1496.001 Resource Hijacking: Compute Hijacking</b><br/><b>Description</b>: XMRig Monero miner deployed, disguised as u201cmsedge.exeu201d, to monetize infected hosts."] class tech_resourcehijack technique artifact_xmrig["<b>Artifact</b> – <b>File</b>: XMRig miner binary named <code>msedge.exe</code>"] class artifact_xmrig artifact tech_exfilftp –>|provides resources for| tech_resourcehijack tech_resourcehijack –>|executes| artifact_xmrig %% Step 18 u2013 Browser Information Discovery tech_browserdisc["<b>Technique</b> – <b>T1217 Browser Information Discovery</b><br/><b>Description</b>: Attacker enumerated browser information to locate additional credentials and session data."] class tech_browserdisc technique artifact_browser_info["<b>Artifact</b> – <b>Data</b>: Browser version, profile paths, installed extensions"] class artifact_browser_info artifact tech_resourcehijack –>|collects| tech_browserdisc tech_browserdisc –>|gathers| artifact_browser_info "
Attack Flow
Detections
Possible Data Infiltration / Exfiltration / C2 via Third Party Services / Tools (via dns)
View
Windows Defender Preferences Suspicious Changes (via powershell)
View
Suspicious Binary / Scripts in Autostart Location (via file_event)
View
Hidden File Was Created On Linux Host (via file_event)
View
Possible Data Infiltration / Exfiltration / C2 via Third Party Services / Tools (via proxy)
View
IOCs (Emails) to detect: Hunting Lazarus: Inside the Contagious Interview C2 Infrastructure
View
IOCs (DestinationIP) to detect: Hunting Lazarus: Inside the Contagious Interview C2 Infrastructure
View
IOCs (SourceIP) to detect: Hunting Lazarus: Inside the Contagious Interview C2 Infrastructure
View
IOCs (HashSha256) to detect: Hunting Lazarus: Inside the Contagious Interview C2 Infrastructure
View
Suspicious getCookie Function Fetching Malicious JavaScript from Vercel Domain [Windows File Event]
View
Suspicious Use of Function.constructor in errorHandler.js for Backend RCE [Windows File Event]
View
Masquerading of Malicious Processes as RuntimeBroker and XMRig Miner as msedge.exe [Windows Process Creation]
View
Malicious VSCode Auto-Execution Configuration [Windows File Event]
View
Simulation Execution
Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.
Attack Narrative & Commands
The adversary copies the legitimate RuntimeBroker.exe binary to a non‑standard location (%TEMP%) to masquerade as a trusted process while avoiding detection based on known system paths. By executing the copy, the process creation event contains the expected image name but a path that fails the “System32” containment check, satisfying selection_runtime.
Regression Test Script
# -----------------------------------------------
# TC-20260114-A1B2C – Masquerading Simulation
# -----------------------------------------------
# 1. Define paths
$src = "$env:SystemRootSystem32RuntimeBroker.exe"
$dest = "$env:TEMPRuntimeBroker.exe"
# 2. Copy the legitimate binary to a non‑system directory
Copy-Item -Path $src -Destination $dest -Force
# 3. Execute the copied binary (this should trigger the Sigma rule)
Start-Process -FilePath $dest -WindowStyle Hidden
# 4. OPTIONAL: Simulate the msedge masquerade (miner) scenario
# (Copy any benign executable, rename to msedge.exe, place under %LOCALAPPDATA%MicrosoftWindowsApplications)
$minerSrc = "$env:SystemRootSystem32notepad.exe"
$minerDest = "$env:LOCALAPPDATAMicrosoftWindowsApplicationsmsedge.exe"
Copy-Item -Path $minerSrc -Destination $minerDest -Force
Start-Process -FilePath $minerDest -WindowStyle Hidden
# -----------------------------------------------Cleanup Commands
# Remove the malicious copies
Remove-Item -Path "$env:TEMPRuntimeBroker.exe" -Force -ErrorAction SilentlyContinue
Remove-Item -Path "$env:LOCALAPPDATAMicrosoftWindowsApplicationsmsedge.exe" -Force -ErrorAction SilentlyContinue