Telnyx Targeted - TeamPCP Supply Chain Attack Grows
Basically, bad software was uploaded to a popular coding website, affecting many users.
The Telnyx SDK has been compromised in a supply chain attack by TeamPCP, affecting users across multiple platforms. Immediate action is needed to secure systems and credentials. This attack highlights the risks associated with open-source software dependencies.
What Happened
The popular Telnyx Python SDK has been compromised in a growing supply chain attack orchestrated by the TeamPCP group. This attack, which began on March 19, has already affected various open-source platforms, including NPM, Docker Hub, and Kubernetes. Recently, two malicious versions of the Telnyx SDK were uploaded to the PyPI registry, targeting users on Windows, macOS, and Linux systems.
These malicious packages, versions 4.87.1 and 4.87.2, have been downloaded over 670,000 times. They contain a disguised WAV file that executes harmful scripts, potentially compromising the systems of those who installed them. The WAV file appears legitimate but contains a hidden payload that can extract sensitive information from users' machines.
Who's Being Targeted
The attack primarily affects developers and organizations that utilize the Telnyx SDK for cloud-based voice solutions. Given the SDK's popularity, the blast radius extends far beyond just Telnyx users. Over 470 repositories have been identified as running malicious versions of the Trivy GitHub Action, and more than 1,900 packages that depend on LiteLLM could also be compromised, increasing the risk of widespread infection.
As the attack unfolds, it is crucial for users of the Telnyx SDK to understand their exposure and the potential impact on their projects and data security. The nature of supply chain attacks means that even those who may not directly use the malicious SDK could be affected through dependencies.
Tactics & Techniques
TeamPCP's tactics in this campaign involve uploading malicious packages to trusted repositories, which can easily deceive developers into downloading them. The infected Telnyx SDK packages contain a WAV file that, when executed, decodes a secondary payload designed to exfiltrate sensitive information, such as session keys. This method of hiding malicious code within seemingly harmless files is a common tactic among cybercriminals.
The data exfiltrated by these malicious scripts is encrypted using asymmetric encryption (RSA), with a public key that has been linked to previous TeamPCP attacks. This indicates a cohesive strategy by the group to maintain operational security while targeting a wide array of users across multiple platforms.
Defensive Measures
For those who have installed the compromised versions of the Telnyx SDK, immediate action is necessary. Users should:
- Rotate all credentials, including API keys and SSH keys.
- Scan their systems for any signs of infection or unauthorized access.
- Monitor their networks for unusual activity that could indicate a breach.
Organizations should also implement stricter controls on software dependencies and conduct regular audits of their open-source components to mitigate the risks associated with supply chain attacks. As the landscape of cyber threats evolves, staying informed and vigilant is essential for maintaining security.