Malware affecting NetBeans to inject backdoors into compiled projects

GitHub identified Malicious software targeting projects in the NetBeans integrated development environment and using the build process for distribution. Investigations revealed that this malware, named Octopus Scanner, had stealthily integrated backdoors into 26 open-source projects hosted on GitHub. The first traces of Octopus Scanner appeared in August 2018.

The malware can detect files with NetBeans projects and inject its code into project files and compiled JAR files. The algorithm works by locating the NetBeans directory with the user's projects, iterating through all projects in that directory, and copying the malicious script into nbproject/cache.dat and making changes to the file nbproject/build-impl.xml to invoke this script on each project build. During the build, a copy of the malware is included in the resulting JAR files, which then become sources for further distribution. For instance, malicious files were placed in the repositories of the aforementioned 26 open projects, as well as various other projects upon the release of new versions.

When a user downloads and runs the infected JAR file, a new cycle of searching for NetBeans and injecting malicious code begins on their system, mirroring the behavior of self-replicating computer viruses. In addition to self-replication functionality, the malicious code also includes backdoor features for providing remote access to the system. At the time of the incident analysis, the command and control (C&C) servers managing the backdoor were inactive.

Overall, four infection variants were identified during the examination of the affected projects. In one variant, a startup file named "$HOME/.config/autostart/octo.desktop" was created in Linux to activate the backdoor, while in Windows, scheduled tasks through schtasks were utilized for launching. Other created files included:

• $HOME/.local/share/bbauto
• $HOME/.config/autostart/none.desktop
• $HOME/.config/autostart/.desktop
• $HOME/.local/share/Main.class
• $HOME/Library/LaunchAgents/AutoUpdater.dat
• $HOME/Library/LaunchAgents/AutoUpdater.plist
• $HOME/Library/LaunchAgents/SoftwareSync.plist
• $HOME/Library/LaunchAgents/Main.class

The backdoor could be used to add bookmarks to the developer's code, orchestrate the leakage of proprietary system code, steal confidential data, and hijack accounts. Researchers from GitHub do not rule out that the malicious activity is not limited to NetBeans and that there may be other variants of Octopus Scanner infiltrating to spread during the build process based on Make, MsBuild, Gradle, and other systems.

The names of the affected projects are not mentioned, but they can easily be found found through a GitHub search using the mask "cache.dat". Among the projects where traces of malicious activity were found: V2Mp3Player, JavaPacman, Kosim-Framework, Point-of-Sale, 2D-Physics-Simulations, PacmanGame, GuessTheAnimal, SnakeCenterBox4, NumericSequence, CallCenter, GerundProject, pacman-java_ai, SuperMario-FR-.

Source: opennet.ru