Investigating Threat Actor Targeting Researchers, Academics

Investigating a Threat Actor Targeting Security Researchers and Academics

Speakers: Christophe Tafani-Dereeper, Matt Muir

Conference: DEF CON 33

YouTube: https://www.youtube.com/watch?v=iTGnoDEYlog

Slides: https://media.defcon.org/DEF%20CON%2033/DEF%20CON%2033%20presentations/Christophe%20Tafani-Dereeper%20Matt%20Muir%20-%20Weaponizing%20Trust%20Investigating%20a%20Threat%20Actor%20Targeting%20Security%20Researchers%20and%20Academics.pdf

Overview

Christophe Tafani-Dereeper and Matt Muir from Datadog presented "Weaponizing Trust," a detailed investigation into a threat actor they designate MUD-1244, which they began tracking in December 2024. MUD-1244 conducted a sophisticated, long-running campaign distributing malicious packages through npm and GitHub — specifically targeting security researchers, academics, and developers by creating highly convincing trojanized tools that appeared legitimate and even referenced in academic publications. The campaign abused the trust that researchers and developers place in open source tooling, academic citations, and peer-reviewed project references. The investigation uncovered a supply chain of malicious packages, C2 infrastructure, and a consistent malware payload designed for credential theft and persistent remote access.

Background

▶ Watch: Introduction: Threat actor targeting security researchers and academics (0:16)

The investigation began with a Checkmarx blog post in December 2024 by Yehuda Gelb describing a malicious npm package called ox-engine-xml-rpc. This package closely mimicked the legitimate xml-rpc package: identical README, same documented functionality, nearly identical code — except for an extraneous validator.js file containing obfuscated code. The malicious package had been published under a name similar enough to the legitimate one to attract accidental installs or to be installed deliberately by developers who found it cited somewhere.

That initial package was the entry point into a much larger investigation. Tafani-Dereeper and Muir traced the malware infrastructure outward from the initial package, identifying related packages, infrastructure, and ultimately the targeting methodology of the actor — which turned out to be unusually specific and sophisticated.

The threat actor's strategy represented a novel abuse of academic and professional trust: rather than simply creating generic-sounding packages and waiting for accidental typosquat installs, MUD-1244 specifically targeted the security research community by creating tools that appeared in the context of legitimate security research projects — PoC exploits, academic paper companion code, and research tool releases.

Key Findings

▶ Watch: How researchers and academics are specifically targeted (5:51)

• MUD-1244 created a network of malicious npm packages and GitHub repositories designed to be discovered and installed by security researchers and academics through legitimate research channels.
• The actor trojanized PoC exploit code published on GitHub. When a researcher searched for a proof-of-concept for a specific CVE and found the actor's repository, they installed a backdoor believing they were getting a legitimate research tool.
• Academic paper companion repositories were created or mimicked, providing fake "code implementations" of published research papers that contained the malware payload alongside working implementations of the described algorithm.
• The malware payload consisted of a credential harvester targeting AWS credentials (particularly .aws/credentials), SSH keys, shell history, and a reverse shell backdoor providing persistent remote access.
• Infrastructure reuse enabled attribution. The C2 server infrastructure shared characteristics across multiple packages, allowing the researchers to cluster the activity and attribute it to a single actor.
• The campaign was active for months before the Checkmarx disclosure, with packages that had accumulated installs indicating real victims.

Technical Deep Dive

▶ Watch: Social engineering techniques used against security community (6:14)

Package discovery and initial analysis:

The validator.js file in the malicious ox-engine-xml-rpc package contained multi-stage obfuscated JavaScript. Deobfuscation revealed:

1. A check for the operating system (Linux/macOS targets, Windows skipped)
2. Retrieval of an additional payload from a hardcoded C2 server
3. Execution of the retrieved payload

The malware payload: The downloaded payload was a shell script (later a compiled binary for some variants) that:

• Searched for and exfiltrated ~/.aws/credentials and ~/.aws/config
• Harvested SSH private keys from ~/.ssh/
• Collected shell history files (.bash_history, .zsh_history)
• Downloaded and executed a persistent reverse shell connecting to the C2 server

The GitHub PoC trojanization technique: The researchers identified numerous GitHub repositories created by the actor that purported to be proof-of-concept code for real CVEs. These repositories appeared credible because:

• They had working exploit code (copy-modified from legitimate PoCs)
• They had realistic commit histories
• Some had been star-farmed to appear popular
• The README files matched the CVE descriptions accurately

When a researcher cloned and ran the "PoC," the malicious component executed alongside the legitimate exploit code.

Academic paper companion repositories: Several repositories claimed to implement algorithms described in real security research papers. The implementations were functional (the algorithms worked), but contained the backdoor payload. Researchers reproducing results from papers would install these repositories as a natural part of their workflow.

Infrastructure analysis: C2 servers used by the various packages shared:

• Specific ASN and hosting provider characteristics
• Similar URL path patterns for payload delivery
• Timing correlations in domain registration

The researchers used passive DNS data, certificate transparency logs, and package metadata timestamps to map the infrastructure and confirm the single-actor hypothesis.

Detection of the actor's account: The npm accounts and GitHub accounts used to publish the malicious packages shared characteristics — profile creation timing, follower patterns, and account naming conventions — that allowed the researchers to identify and enumerate the full set of actor-controlled accounts.

Demo / Proof of Concept

▶ Watch: Victim profiles and what the attacker seeks to steal (10:42)

The speakers walked through:

• Live deobfuscation of the validator.js payload, showing the multi-stage unpacking process and the final credential harvesting and reverse shell logic.
• A demonstration of how a malicious PoC repository appeared in GitHub search results for a specific CVE, showing the search ranking and apparent legitimacy.
• A walkthrough of the C2 infrastructure — the payload delivery endpoints, the shell script structure, and what data was sent back to the attacker.
• An infrastructure graph showing the connections between npm packages, GitHub accounts, and C2 domains, illustrating the breadth of the campaign.

Defensive Implications

▶ Watch: Attribution indicators and suspected threat actor identity (16:14)

The security research community is a high-value target. Security researchers and academics have credentials, access to sensitive systems, and often work on findings that have real-world value to nation-state actors or sophisticated criminals. Targeting researchers through their tooling and professional workflows is a logical and effective strategy.

Treat PoC code from unknown sources with extreme caution. Proof-of-concept code published on GitHub by unknown authors should not be executed directly. Review the code before running, use isolated VMs for testing, and prefer PoCs from established researchers with verifiable identities.

Verify package names carefully. Typosquatting and package name mimicry are the primary delivery mechanisms. Use package managers' built-in integrity checking, pin to specific versions, and verify publisher identity before installing packages in research or development environments.

Protect AWS credentials and SSH keys. These were the primary exfiltration targets. Use short-lived credentials via AWS IAM Roles and instance profiles rather than long-lived access keys. Restrict SSH key usage and rotate keys regularly. Consider hardware security keys for SSH authentication.

Use isolated environments for running untrusted code. Research tooling that clones and runs external code should do so in network-isolated VMs or containers that do not have access to credentials, SSH keys, or other sensitive materials.

Monitor for outbound connections from research systems. Reverse shells connecting to external infrastructure are detectable via network monitoring. Security researchers' workstations and lab systems should have the same outbound traffic monitoring as production systems.

Key Takeaways

1. MUD-1244 conducted a sophisticated, targeted campaign against the security research community by distributing malware through trusted research channels: npm packages, GitHub PoC repositories, and academic paper companion code.
2. The campaign weaponized professional trust — security researchers expect certain types of tooling to be legitimate and safe, and the actor exploited that expectation.
3. The true objective was credential theft (AWS, SSH) and persistent backdoor access to researchers' systems, not the generic opportunistic credential dumps typical of npm supply chain attacks.
4. Infrastructure reuse enabled the researchers to cluster the activity and attribute a broad set of malicious packages and repositories to a single actor.
5. The PoC trojanization and academic companion repository techniques are novel delivery mechanisms that security researchers must add to their threat model.
6. The investigation itself was non-linear and required iterative pivoting across npm metadata, GitHub data, passive DNS, and certificate transparency logs — a realistic picture of threat intelligence work.

About the Speaker(s)

▶ Watch: Protective measures for researchers and academics (18:44)

Christophe Tafani-Dereeper is a security researcher at Datadog with a focus on cloud security and open source security topics. He conducts threat research when opportunities arise in his work.

Matt Muir is a security researcher at Datadog based in Scotland, primarily focusing on malware analysis and threat research. This was the first DEF CON talk for both speakers, traveling from Switzerland and Scotland respectively.