Silent Intrusion: Unraveling The Sophisticated Attack Leveraging VS Code For Unauthorized Access - Cyble
Tags
cmtmf-attack-pattern: Application Layer Protocol Command And Scripting Interpreter Masquerading Scheduled Task/Job
maec-delivery-vectors: Watering Hole
attack-pattern: Data Application Layer Protocol - T1437 Command And Scripting Interpreter - T1623 Dns - T1071.004 Dns - T1590.002 Exploits - T1587.004 Exploits - T1588.005 File And Directory Discovery - T1420 Malware - T1587.001 Malware - T1588.001 Masquerading - T1655 Match Legitimate Name Or Location - T1036.005 Match Legitimate Name Or Location - T1655.001 Process Discovery - T1424 System Information Discovery - T1426 Phishing - T1660 Phishing - T1566 Python - T1059.006 Scheduled Task - T1053.005 Scheduled Task/Job - T1603 Server - T1583.004 Server - T1584.004 Software - T1592.002 Ssh - T1021.004 Web Protocols - T1071.001 Web Protocols - T1437.001 Tool - T1588.002 Standard Application Layer Protocol - T1071 Command-Line Interface - T1059 File And Directory Discovery - T1083 Masquerading - T1036 Process Discovery - T1057 Scheduled Task - T1053 System Information Discovery - T1082 Masquerading
Show in Graph
Common Information
Type Value
UUID 1cdc4eae-6008-4ecd-be84-9d3b5c7dd39c
Fingerprint acc81d10a32febc8
Analysis status DONE
Considered CTI value 2
Text language
Published Oct. 1, 2024, 9:12 a.m.
Added to db Oct. 1, 2024, 3:23 p.m.
Last updated Oct. 12, 2024, 9:55 a.m.
Headline Silent Intrusion: Unraveling the Sophisticated Attack Leveraging VS Code for Unauthorized Access
Title Silent Intrusion: Unraveling The Sophisticated Attack Leveraging VS Code For Unauthorized Access - Cyble
Detected Hints/Tags/Attributes 80/3/27
Source URLs
Redirection Url
Details Source https://cyble.com/blog/silent-intrusion-unraveling-the-sophisticated-attack-leveraging-vs-code-for-unauthorized-access/
URL Provider
Details Provider Source level domain
Details cyble.com cyble.com
RSS Feed
Details Id Enabled Feed title Url Added to db
Details 98 ✔ Cyble https://cyble.com/feed/ 2024-08-30 22:08
Attributes
Details Type #Events CTI Value
Details Domain 3 
python-3.12.5-embed-amd64.zip
Details Domain 37 
paste.ee
Details Domain 9 
update.py
Details Domain 3 
requestrepo.com
Details Domain 3757 
github.com
Details File 3 
5-embed-amd64.zip
Details File 6 
tar.exe
Details File 9 
update.py
Details File 25 
pythonw.exe
Details File 39 
code.exe
Details File 51 
output.txt
Details File 1 
output2.txt
Details Github username 4 
login
Details sha1 2 
97dec172d3256f8ca4bfb2143f3f76b503ca0534
Details sha256 2 
281766109f2375a01bad80478fd18841eccaefc1ee9277179cc7ff075d1beae2
Details sha256 2 
c7f07bdfb91653f53782885a3685436e2e965e1c5f4863c03f5a9825c0364489
Details MITRE ATT&CK Techniques 53 
T1059.006
Details MITRE ATT&CK Techniques 245 
T1053.005
Details MITRE ATT&CK Techniques 153 
T1036.005
Details MITRE ATT&CK Techniques 943 
T1082
Details MITRE ATT&CK Techniques 12 
T1420
Details MITRE ATT&CK Techniques 397 
T1057
Details MITRE ATT&CK Techniques 380 
T1071.001
Details Url 3 
https://paste.ee/r/dqjrd/0
Details Url 2 
https://az764295.vo.msecnd.net/stable/97dec172d3256f8ca4bfb2143f3f76b503ca0534/vscode_cli_win32_x64_cli.zip
Details Url 2 
http://requestrepo.com/r/2yxp98b3
Details Url 2 
https://github.com/login/device