![\"Two](\"https:\/\/www.cryptocabaret.com\/wp-content\/uploads\/2020\/12\/two-rubygems-infected-with-crypto-stealing-feature-malware-spotted-by-researchers-768x432.jpg\")
<\/p>\n<\/p>\n
New infected Rubygems packages have been spotted in its open-source software repository and which contained malicious code mainly used to steal cryptocurrencies from users via supply chain attack.<\/strong><\/p>\n According to Ax Sharma, a security researcher at Sonatype, the two gems detected<\/a> \u2014 pretty_color and ruby-bitcoin \u2014 had malware that deployed the attack on Windows machines and replaced any bitcoin (BTC<\/a>), ethereum (ETH<\/a>), or monero (XMR<\/a>) wallet addresses found on the victim\u2019s clipboard by the attackers\u2019 ones.<\/p>\n Rubygems is a package manager for the Ruby programming language that allows developers to integrate code developed by other people. Anyone can upload a \u201cgem\u201d to the repository, open in some way the doors for threat actors to upload their malicious packages.<\/p>\n The researcher explained further about how the attack operates:<\/p>\n This means if a user who had mistakenly installed either of these gems was to copy-paste a bitcoin recipient wallet address somewhere on their system, the address would be replaced with that of the attacker, who\u2019d now receive the bitcoins.<\/p>\n<\/blockquote>\n During an analysis conducted by the Sonatype Security Research team, it was detected that unless the victim double-checks the wallet address after they paste it, the clipboard hijacker deployed during the supply chain attack will quietly change the address by creating separate malicious scripts contained in VBS files.<\/p>\n <\/ins> <\/ins> <\/p>\n Sharma also warned on the growing trend that supply chain attacks have so far in 2020, considering it a \u201cbigger concern.\u201d<\/p>\n According to Sonatype\u2019s 2020 State of the Software Supply Chain report<\/a>, there was a 430% increase in upstream software supply chain attacks over the past year, making it \u201cvirtually impossible\u201d to chase and keep track of such components manually.<\/p>\n Sonatype\u2019s Sharma adds:<\/p>\n Of all activities a ransomware group may conduct on a compromised system, replacing bitcoin wallet address on the clipboard feels more akin to a trivial mischief by an amateur threat actor than to a sophisticated ransomware operation. However, this coincidence does raise a bigger concern, considering how rampant software supply chain attacks have been in 2020.<\/p>\n<\/blockquote>\n Will we see a leading role in crypto-related supply chain attacks in 2021? Let us know in the comments section below.<\/strong><\/em><\/p>\n The post Two Rubygems Infected With Crypto-Stealing Feature Malware Spotted by Researchers<\/a> appeared first on Bitcoin News<\/a>.<\/p>\nTwo Cryptocurrency-Stealers Rubygems Detected by Researchers at Sonatype<\/h2>\n
\n
Supply Chain Attacks: A Growing Concern<\/h2>\n
\n