This threat involves a malicious Go module that impersonates the widely used golang.org/x/crypto library, a critical cryptography package in the Go programming ecosystem. The malicious code is embedded specifically in the ssh/terminal/terminal.go file, where it introduces a backdoor capable of capturing passwords entered via terminal sessions. Once passwords are captured, they are exfiltrated to attacker-controlled infrastructure. The attack chain further includes a Linux stager component that establishes persistence by installing an SSH key, modifies firewall rules to weaken security, and deploys the Rekoobe backdoor malware, which is known for remote command execution and stealthy persistence. The threat actor leverages GitHub repositories to stage malicious payloads, disguising them as media files (e.g., .mp5 files) to evade detection. This supply chain attack targets high-trust cryptographic libraries, which are often dependencies in cloud-native applications and infrastructure, increasing the potential impact. The adversary behind this campaign is identified as APT31, a sophisticated threat actor group with a history of espionage and supply chain compromises. Indicators of compromise include specific file hashes, IP addresses, domains, and URLs associated with the malicious infrastructure. The campaign underscores the critical need for secure software supply chain practices, including verification of module authenticity, dependency auditing, and monitoring of development workflows for suspicious changes. Although no active exploitation in the wild has been confirmed, the complexity and stealth of this attack vector make it a serious concern for organizations using Go modules in their software stacks.

The impact of this threat is significant for organizations that develop or deploy software using Go, especially those relying on the golang.org/x/crypto module for cryptographic functions. By compromising a trusted cryptographic library, attackers can steal sensitive credentials such as passwords, leading to unauthorized access to systems and data breaches. The deployment of the Rekoobe backdoor enables persistent remote access, allowing attackers to execute arbitrary commands, move laterally within networks, and potentially exfiltrate sensitive information. Cloud environments are particularly at risk due to their heavy reliance on Go-based microservices and infrastructure automation tools. The weakening of firewall rules further exposes affected systems to external attacks. This supply chain compromise can undermine trust in software dependencies, disrupt development pipelines, and cause widespread security incidents if malicious modules propagate through automated builds and deployments. Organizations may face operational disruptions, data loss, intellectual property theft, and reputational damage. The stealthy nature of the attack and use of legitimate platforms like GitHub for staging complicate detection and response efforts.

1. Implement strict verification of Go modules by using cryptographic signatures and checksums to ensure authenticity before integration. 2. Employ dependency scanning tools that can detect impersonation or typosquatting in module names and alert on suspicious changes. 3. Enforce code review policies specifically for third-party dependencies and monitor for unexpected modifications in critical libraries like cryptography modules. 4. Use private module proxies or mirrors to control and vet external dependencies before they enter the build pipeline. 5. Monitor network traffic for unusual connections to known malicious domains and IP addresses associated with this campaign (e.g., spoolsv.cc, spoolsv.net, and related URLs). 6. Harden Linux host configurations by restricting SSH key installations and firewall rule changes through configuration management and auditing. 7. Deploy endpoint detection and response (EDR) solutions capable of identifying backdoor behaviors such as Rekoobe’s persistence mechanisms. 8. Educate developers and DevOps teams about supply chain risks and encourage the use of reproducible builds and dependency locking. 9. Regularly audit and rotate credentials to limit the impact of stolen passwords. 10. Establish incident response plans that include supply chain compromise scenarios to enable rapid containment and remediation.