[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Threat Hunting · markdown

IOCs and hunt leads from Socket Threat Research (Nov 9)

Hunt: frameworkmetrics[.]xyz loader, ~/.solidity persistence and a hidden ScreenConnect client from the bee-js / Swarm Desktop compromise

  • DNS/proxy: api[.]frameworkmetrics[.]xyz (paths /v1/analytics, /v1/electron, /v1/swarm/report); hub 193[.]57[.]9[.]155:4912 and earlier hubs on port 4912; ScreenConnect relay 185[.]232[.]84[.]169:8041.
  • RPC: eth_call to contract 0xf8a900Db50b3331be6B768bA460BB59f3E40C344 with data 0x02d91518, especially from binaries under ~/.solidity/.
  • Persistence: ~/.solidity/, LaunchAgent com.solidity.langsupport.runner, systemd user unit solidity-langsupport-runner.service, Windows service ScreenConnect Client (5cbe79c9c25524df). Reinstalling the app does not remove them.
  • Logs: Bee Desktop version: 0.56.2 (production) in bee-desktop.log; npm install-script warnings naming @ethersphere/bee-js@13.3.0 (postinstall: node scripts/generate-version.cjs).
  • Hashes: Swarm Desktop 0.56.2 dist/desktop/src/index.js SHA-256 f81315968e679b48f6bdff1c9b928bb223230d07f44d7948412c2250c2a14deb; bee-js-13.3.0.tgz d01fdf241aa9e0a1ba6ebc19f8f667af1bf652745021c5050126cb7036f7ce58. Full list in Socket's post.

Sources: Socket: Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor (Nov 9)