Blockchain security provider SlowMist has issued an urgent security alert for Ethereum ecosystem users after a complex supply chain attack was detected on Ethersphere’s software.
In a recent post on the X social media platform, SlowMist announced that two pieces of software have been compromised by hackers.
The cybersecurity firm claims that attackers were able to break into GitHub accounts and take advantage of legitimate software release processes to deploy malicious software.
The attack could potentially impact users on multiple operating systems, including Windows, macOS and Linux.
The affected software is part of Swarm, a decentralized storage network belonging to the wider Ethereum ecosystem.
Security experts have cautioned that these malicious software releases could enable attackers to compromise cryptocurrency wallet credentials, steal private keys and open up permanent backdoors on affected systems.
Sophisticated malware attack
One of the most concerning features of this attack is the involvement of Ethereum’s blockchain infrastructure in helping manage the malicious software.
SlowMist explains that this malware retrieves and runs malicious JavaScript code.
However, this attack is not just a simple malware infection.
The cybersecurity firm disclosed that attackers are leveraging an Ethereum smart contract as a decentralized command-and-control (C2) configuration repository.
This gives attackers the ability to dynamically update server addresses managing the malware without requiring a new deployment of the malicious software.
Interestingly, the same Ethereum smart contract was previously associated with the infamous SleepyDuck and EtherDuck malware attacks. These campaigns targeted developers using malicious extensions on the Open VSX marketplace.
This points to the possibility that the new attack may be part of a broader operation aimed at compromising cryptocurrency developers and users.
Independent security researchers from Socket and SafeDep also discovered malware aimed at stealing Swarm wallet files and deploying persistent remote access tools.
As a result of this discovery, SlowMist advised users to immediately uninstall the affected package and roll back to the clean version 13.2.0.
In the meantime, users of Swarm Desktop v0.56.2 were advised to update to the clean v0.56.3 software release.
