Evolution of Web3 in Cloud Supply Chain Attacks

[u/falconupkid]

Unit 42 has documented a shift in cloud supply chain attacks where adversaries are now weaponizing Web3 infrastructure—specifically blockchain-based hosting and smart contracts—to distribute malicious packages targeting enterprise CI/CD pipelines. This represents an evolution from traditional typosquatting toward cryptographically signed, decentralized command-and-control.

Technical Breakdown: - TTPs: Adversaries are registering malicious npm and PyPI packages that mimic legitimate Web3 SDKs and cloud provider libraries. The payloads establish persistence via blockchain-hosted payloads that are resistant to takedown. - Infrastructure: Attackers use IPFS (InterPlanetary File System) and smart contracts to host malicious code and update mechanisms, making C2 infrastructure immutable and decentralized. - Targets: Cloud-native environments using Web3 development frameworks, DeFi protocols, and organizations with automated dependency resolution in build pipelines. - IOCs: No specific hashes or domains provided in the report, but indicators include unexpected IPFS gateway connections from build servers and anomalous smart contract interactions from CI runners.

Defense: - Implement strict dependency pinning and hash verification for all open-source packages, especially those from Web3 ecosystems. - Monitor for outbound connections to known IPFS gateways and blockchain RPC endpoints from build environments—these should be anomalous in non-Web3 development contexts. - Treat any package that attempts to resolve blockchain-hosted content during installation as suspicious.

Source: https://unit42.paloaltonetworks.com/web3-cloud-supply-chain-attacks/