Poisoned Pipeline / Incidents / AS236

AS236 · 2019-11

Monero CLI binaries stole wallet seeds

Windows softwareInstaller / update channel

Catalogued from the tstromberg supplychain-attack-data dataset
(community-curated incident corpus). Included because first-party
sources exist for it; see the links below — vendor advisories, project
incident reports, and researcher write-ups. Not based on aggregator
coverage.

Mapped techniques

• T0172 Runtime backdoor
• T0184 Harvesting sensitive information from files

supply-chain campaign

Sources

• https://github.com/monero-project/monero/issues/6151
• https://web.getmonero.org/2019/11/19/warning-compromised-binaries.html
• https://serhack.me/articles/cli-binaries-compromised-monero-analysis/
• https://bartblaze.blogspot.com/2019/11/monero-project-compromised.html
• https://arstechnica.com/information-technology/2019/11/official-monero-website-is-hacked-to-deliver-currency-stealing-malware/