Poisoned Pipeline

Poisoned Pipeline / Techniques / T0110

T0110 · Resource Development · TA02 · observed in 25 incident(s)

Advertise malicious artifact

Container Security Open Source Security

An Advertise Malicious Artifact attack is a type of cyber attack in which an attacker distributes a malicious package or container image to a broader audience, typically by advertising it on popular repositories or registries.
The goal of this attack is to entice users into downloading and using the malicious artifact, thereby compromising their systems.
In this attack, the attacker may create a fake developer account or use an existing legitimate account to upload the malicious artifact to popular repositories or registries such as PyPI or DockerHub.
The attacker may then use various techniques to promote the malicious artifact, such as forum promotion, commenting, using misleading descriptions, tags, or keywords, or by hijacking popular package names.
Once users download and install the malicious package or container image, it can compromise their systems and potentially cause significant harm, such as stealing sensitive data or taking control of the system.

Where this idea came from

Security article

Inherited article citation; conference: DEF CON 34 “Hacking the Hackers who Hack Hackers” (Morag) — FirewallFalcon is promoted on Telegram as a legitimate open-source VPN manager and installs backdoors. Forum-style advertisement of a malicious tool, not a registry upload.

Mitigations

Detections

Observed in incidents (25)

References