SANS Stormcast Wednesday, April 1st, 2026: Application Control Bypass; Axios NPM Module Compromise; TeamPCP vs Cloud

If you are not able to play the podcast using the player below: Use this direct link to the audio file: https://traffic.libsyn.com/securitypodcast/9874.mp3

previous

Application Control Bypass; Axios NPM Module Compromise; TeamPCP vs Cloud

00:00

iTunes

MP3 Download

RSS Feed

Google

Podbean

Amazon Echo

YouTube

Spreaker

Spotify

Discussion

Login here to join the discussion.

Podcast Transcript

 Hello and welcome to the Wednesday, April 1st, 2026
 edition of the SANS Internet Storm Center's Stormcast. My
 name is Johannes Ullrich and today I am recording from
 Orlando, Florida. This episode is brought to you by the SANS
 .edu Bachelor's Degree Program in Applied Cybersecurity. An
 interesting diary today by Xavier showing how simple it
 can be to bypass some more advanced next-generation
 firewall features like, for example, Palo Alto's
 Application Control. What Xavier did here is essentially
 just set up a simple Netcat tunnel. Now, the promise of
 Application Control is that it recognizes what application
 protocol is used in a certain connection and is then able to
 shut down connections on odd ports that don't look like
 they are supporting a particular application
 protocol or an application that is atypical for the
 particular port being used. Now, the problem here is that
 it takes these next-generation firewalls a little while to
 figure out what application is running before it is being
 shut down. And what Xavier found with Palo Alto in
 particular, that it takes 5 ,000 bytes in order to figure
 out what application is running. So you're able to
 exfiltrate up to 5,000 bytes. Well, Xavier turned it into a
 little sort of wrapper around Netcat to then be able to even
 exfiltrate larger files. All it takes is that you're
 cutting them into 5,000 byte chunks and everything is
 working just fine. So a fairly simple and, well, kind of
 interesting also artifact here of this particular Application
 Control algorithm. There is still, of course, a chance to
 detect it if you're looking for connections that have just
 about that size or if you're just looking for a large
 number of connections on odd ports. But this is not sort of
 what is then done via these Application Control features
 in your firewall. And yes, it looks like supply chain
 compromises are only getting worse. Yesterday, the very
 popular NPM package Axios was compromised. This package does
 implement an HTTP client, you know, anything sort of
 connecting to HTTP, maybe using Axios in order to
 connect to APIs and similar resources. The compromise
 originated with the compromise of the administrators for the
 Axios GitHub repository getting compromised. It's not
 really clear how this happened yet. But given that Team PCP
 recently did collect so many developer credentials, it's
 very possible that this is one of the the credentials they
 caught. Now, the follow-up, the compromise here doesn't
 look like Team PCP. The techniques look a little bit
 different. But of course, Team PCP also started to sell off
 some of the credentials that they collected and will act as
 sort of an initial Axios broker. The compromise did not
 change the Axios code itself. Instead, it added an
 additional component, plain crypto.js. This particular
 module was not actually used in the code. But by being
 listed as a dependency, it's still being installed. During
 the install, the usual post -install script is being
 called. That post-install script, well, contains the
 malicious code. This malicious code will, depending on the
 operating system, install different remote access tools.
 They have different tools listed for macOS, for Windows,
 as well as for Linux. Yes, it could have been worse. The
 compromise was detected relatively quickly. It lasted
 about three hours. But you want to make sure that you
 don't have this malicious version installed. Also, they
 added a new version. They did not alter any of the existing
 version, which is sort of one of the typical things that
 Team PCP does. Step Security, who documented a lot of these
 issues early on, has put together a nice timeline, also
 put together an analysis of the remote access Trojan and
 did also publish some of the indicators of compromise that
 you can use to detect whether or not your system was
 affected. But remember, some of the files that are being
 installed here are being installed, are being
 uninstalled and removed after the remote access Trojan is
 installed. So that makes sort of here the cleanup slightly
 more difficult. But there are still enough artifacts that
 you can use, according to the Step Security blog. SANS also
 published a live stream today with Josh Wright and Rich
 Green, who go over some of the details that were known at the
 time about this compromise. Still a little bit of a
 developing story. But I think, you know, what I said last
 week with Team PCP, we just have seen sort of the tip of
 the iceberg here. Well, we slowly sort of get a little
 bit down to the iceberg. Still, get your supply chain
 under control. Be careful. Over the next couple of weeks,
 what you're installing. I'm sure we'll see more in the
 next few days. I'm talking about Team PCP and what
 they're up to with published a blog post that they are seeing
 many of the credentials that were apparently stolen as part
 of the trivia round of exploits being used now to
 compromise cloud environments. So they're stating that Team
 PCP is shifting focus here a little bit and going after
 these cloud environments. Again, focusing on data, in
 particular secrets exfiltration. Well, and this
 is it for today. So thanks for listening. Thanks for liking.
 Thanks for subscribing. There is a chance that there will be
 no podcast for Thursday because Wednesday evening I
 have sort of a little timing conflict here. We'll see if I
 find the time to record or not. But otherwise, don't be
 surprised if there is no podcast on Thursday. Thanks
 and talk to you again tomorrow or day after tomorrow. Thanks
 for listening. Thanks for listening.
 Bye. Bye. Bye. Bye. Bye. Bye.