Skip to content

ESET Research: Official Python repository served cyberespionage backdoor, gathered 10,000+ downloads

ESET Research discovered 116 malicious packages in PyPI, the official repository of software for the Python programming language, uploaded across 53 projects. Victims have downloaded these packages over 10,000 times.
The malware delivers a backdoor capable of executing remote commands, exfiltrating files, and taking screenshots. In some cases, the W4SP Stealer or a clipboard monitor that steals cryptocurrency, or both, is delivered instead.
The backdoor component is implemented for both Windows, in Python, and Linux, in Go.

BRATISLAVA, MONTREAL — December 12, 2023 — ESET Research has discovered a cluster of malicious Python projects being distributed via PyPI, the official Python (programming language) package repository. The threat targets both Windows and Linux systems and usually delivers a custom backdoor with cyberespionage capabilities. It allows remote command execution and file exfiltration, and sometimes includes the ability to take screenshots. In some cases, the final payload is a variant of the infamous W4SP Stealer, which steals personal data and credentials, or a simple clipboard monitor to steal cryptocurrency, or both. ESET discovered 116 files (source distributions and wheels) across 53 projects that contain malware. Over the past year, victims downloaded these files more than 10,000 times. From May 2023 onward, the download rate was around 80 per day.

PyPI is popular among Python programmers for sharing and downloading code. Since anyone can contribute to the repository, malware – sometimes posing as legitimate, popular code libraries – can appear. “Some malicious package names do look similar to other, legitimate packages, but we believe the main way they are installed by potential victims isn’t via typosquatting, but social engineering, where they are walked through running pip to install an ‘interesting’ package for whatever reason,” says ESET researcher Marc-Étienne Léveillé, who discovered and analyzed the malicious packages.

Most of the packages had already been taken down by PyPI at the time of the publication of this research. ESET has communicated with PyPI to take action concerning those remaining; presently, all of the known malicious packages are offline.

ESET has observed the operators behind this campaign using three techniques to bundle malicious code into the Python packages. The first technique is to place a “test” module with lightly obfuscated code inside the package. The second technique is to embed PowerShell code in the setup.py file, which is typically run automatically by package managers such as pip to help install Python projects. In the third technique, the operators make no effort to include legitimate code in the package, so that only the malicious code is present, in a lightly obfuscated form.

Typically, the final payload is a custom backdoor capable of remote command execution, file exfiltration, and sometimes the ability to take screenshots. On Windows, the backdoor is implemented in Python. On Linux, the backdoor is implemented in the Go programming language. In some cases, a variant of the infamous W4SP Stealer is used instead of the backdoor, or a simple clipboard monitor is used to steal cryptocurrency, or both. The clipboard monitor targets Bitcoin, Ethereum, Monero, and Litecoin cryptocurrencies.

“Python developers should vet the code they download before installing it on their systems. We expect that such abuse of PyPI will continue and advise caution in installing code from any public software repository,” concludes Léveillé.

For more information about the malicious Python projects in PyPI, check out the blog post “A pernicious potpourri of Python packages in PyPI.” Make sure to follow ESET Research on Twitter (today known as X) for the latest news from ESET Research.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

How Tomorrow’s Guides achieved efficient team segmentation & access control via private gateways

Tomorrow’s Guides is a UK-based company specializing in directory services for care homes and day nurseries. Their review websites help 22.5 million visitors each year to find a perfect spot for family members in need and assist over 15,000 organizations in finding professionals by posting job vacancies. 

Profile of Tomorrow’s Guides web 1400x696

Owned by a parent company, A Place for Mom, a leading senior living service provider in the United States, Tomorrow’s Guides is a local representative that continues its good practices. Thus, high-quality standards make network security one of the primary objectives of the company’s work culture.

Adapting to a situation and security requirements, Tomorrow’s Guides is an outstanding example of how the organization achieved its goals using NordLayer. Leon Tanner, the TechOps Manager, shares the company’s journey of protecting and optimizing team segmentation and access controls to internal resources.

The challenge

Adapting to a hybrid workforce

Tomorrow’s Guides faced the challenge of securely managing network access for its dispersed team. This included a mix of web developers and other internal technical staff with varying levels of access needs to cloud resources and secure systems.

“We’ve transitioned to remote work during the pandemic. Most people were 100% remote, but as we came out of the pandemic, we moved to a hybrid model.”

 

Transitioning to a hybrid work model after the pandemic, the company needed a robust solution to manage access permissions efficiently and securely, especially with their increased workload from the US-based parent company, A Place for Mom.

The solution

Implementing granular team segmentation

Tomorrow’s Guides adopted NordLayer as its network security solution. The decisive criterion for the company was NordLayer’s capability to provide a single IP in the cloud via a VPN gateway, allowing them to restrict access to specific resources efficiently.

“The major selling point for us was having a single IP represented in the cloud, so gateways allowed us to restrict access to specific resources.”

 

NordLayer offered the flexibility and simplicity needed for their diverse and distributed team. The tool enabled the company’s IT admins to create separate gateways for different user groups, like developers and standard users, and tailor access accordingly.

“We group users together by their function, and then these functions get attached to specific gateways that are relevant for their team.”

 

Tomorrow’s Guides approach is to manage user access by applying a more precise strategy. Instead of broadly categorizing users based on existing teams tied to organizational structure, the company provides access to groups organized by individual roles.

Why choose NordLayer

The client wanted a solution to clearly define and control access rights to internal resources and applications. The main objective was to separate developers and regular users from the rest of the organization who worked with less sensitive data.

In 2020, when Tomorrow’s Guides selected our solution, at that time NordLayer had the capability to create two separate organization accounts for a more granular segmentation within the organization. The two different accounts had a clear distinction between cloud-based resources and access rights.

“It was quick, it was flexible, and it was easy to implement. NordLayer was the solution that gave us the flexibility of cloud solutions.”

 

As soon as the functionality of the segmenting network by teams was introduced to secure remote access solution, the publishing house initiated the migration to one NordLayer account.

Centralized organization network management by segmenting teams with NordLayer

Consolidation of NordLayer accounts also helps consolidate and optimize the team’s processes and IT managers’ workload. Segmenting the entire workforce into teams, assigning them to gateways, and adding allowlisted IP addresses to each unit gives better visibility and control over network access management.

“We’re going to use the spare server for backup, so the other server with our service will still be up.”

 

The capability enabled organization administrators to add and create separate Virtual Private Gateways. By grouping employees based on their roles, the system ensures safer resource accessibility and more accurately minimizes the attack surface of their network.

The outcome

Enhanced security and flexibility

The implementation of NordLayer greatly benefitted Tomorrow’s Guides, providing a streamlined and secure method of network management.

“One of the biggest use cases for us is the ability to offboard as well as onboard quickly and to remove access. It reduces the work noise.”

 

Key benefits included the ability to onboard and offboard team members quickly, manage access permissions efficiently, and maintain high levels of security for remote work. The single IP feature made resource allowlisting straightforward.

“It’s really easy to manage. Our ability to get someone on and working is really rapid. And NordLayer also gives us that single IP, which just makes allowlisting resources easy.”

 

The flexibility of the solution was particularly valuable, accommodating the varying access needs of their team across the UK and potentially in the US in the future. Additionally, the solution’s ease of management reduced overhead for the IT team, making it an effective tool for ensuring network security in the hybrid working environment.

Pro cybersecurity tips

Organizational cybersecurity starts before deploying a technological stack and solutions—small steps and actions can greatly impact network security. Leon Tanner from Tomorrow’s Guides has valuable tips on crucial areas to focus on when protecting a business.

If you are looking for a solution that adapts to your cybersecurity needs, helps find an easy and simple answer to network security challenges, and constantly evolves to offer a comprehensive service, contact us to help guide you in your business cybersecurity journey.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About NordLayer
NordLayer is an adaptive network access security solution for modern businesses – from the world’s most trusted cybersecurity brand, Nord Security.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

NordTech: Berlin AppSec Meetup recap

This Autumn, our meetup with the Berlin Application Security community offered a glimpse into some cutting-edge topics in the field. AppSec is increasingly crucial for defending applications from the ever-present threat of malware and hacking attacks.  

Here’s a brief summary of the Nord Security talks. You’ll find links to the full videos as well.

Who downloads your NPM package? Research about NPM public registry bots and scrapers

from Rokas Tiškus

Rokas investigates suspicious bots that scrape packages on Node Package Manager (NPM), the world’s largest software registry. Developers can publish and share JavaScript software using NPM, but what could be driving bots to download this useful information…? Watch on to uncover the methods, patterns, and potential motives behind this dubious activity.

Watch Rokas’s talk on NPM bots

The state of MQTT: IoT’s favored messaging protocol

from Kasparas Bražėnas

Kasparas assesses the state of MQTT, “The Standard for IoT Messaging”. Citing security concerns raised as far back as 2016, he weighs up the protocol in its current form to see if improvements have been made. Tune in for a look at the global MQTT server landscape and persistent risks. Also, some essential tips for securing your ownMQTT environment.

Watch Kasparas’s talk on the state of MQTT

photos from the meetup

NordTech AppSec meetup

Don’t miss the next Nord Security meetup!

Follow us for all future tech events in Berlin and Vilnius.

Interested in creating a safer cyber future with us? Explore our open roles.

New to NordPass?

You don’t need to be a rocket scientist to start using NordPass on a desktop device. Just add the standalone extension and you’re all set — no need to download or install the app!

Check out our detailed support guide for getting started with NordPass quickly and easily.

Once you have the new extension running on your browser, you can start using NordPass to its fullest extent.

If you have any further questions regarding the changes or NordPass in general, do not hesitate to contact our tech-minded support team at support@nordpass.com — they’re ready to take care of any issues you might have. Also, if you have any suggestions or feedback, simply submit a request for our team — we’re all ears, all the time.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About NordPass
NordPass is developed by Nord Security, a company leading the global market of cybersecurity products.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

How to find saved passwords on Mac

One hundred — this is approximately the number of passwords an average user may need to manage across various accounts and platforms these days. 

This fact alone explains why most of us don’t even try to remember our passwords but, instead, choose to save and store them on our devices (or web browsers). It’s just so easy and convenient.

But what if, for some reason, we need to retrieve our stored passwords? Is it complicated? Let’s see what the process looks like when using a Mac device.

How to view saved passwords in Mac system settings

To see all the passwords you have stored on your Mac device, follow these steps:

  1. Click on the Apple menu button and select “System settings.”

  2. Find the “Passwords” section on the list of settings and click on it.

  3. Enter your user account password or use Touch ID to verify your identity.

  4. Go through the list of passwords to find the one you’re looking for.

To delete a password, you just need to click on it and select “Delete password.” However, if you want to update your password, click “Edit,” enter the new password, and click “Save.”

How to view saved passwords in Safari

If you want to access the passwords you store in the Safari browser, simply follow these steps:

  1. Open the Safari browser and click on “Preferences.”

  2. Choose the “Passwords” option located in the top tab.

  3. Verify your identity by entering your Mac password or using Touch ID.

  4. Choose a website from the list to show its stored password.

How to view saved passwords in Chrome

As a Chrome user, you have access to your saved passwords by navigating to the Chrome browser settings. Here’s what the process looks like:

  1. Open Google Chrome and click on the three-dot icon in the top right corner.

  2. Go to the “Settings” section and select “Passwords” under “Auto-fill.” Here you will find a complete list of the credentials stored in your Chrome browser.

  3. To access any of your stored passwords, simply click on the eye icon next to the one you want to check.

  4. Enter your password so that Google Chrome can confirm your identity and show you what the password is.

How to view saved passwords in Firefox

As in the case of Safari and Chrome, the process for locating your password in Mozilla Firefox involves a few straightforward steps:

  1. First, open the Firefox browser, click the “Menu” button, and select “Preferences.”

  2. Choose “Privacy & security” from the left panel.

  3. Navigate to “Logins & passwords” and select “Saved logins.”

  4. Click on the “Show passwords” button.

Why storing passwords on a device (and in browsers) is still problematic

Based on what we discussed, we wouldn’t characterize the process of locating your stored password on a Mac device (and in various browsers) as overly complex. Instead, it appears to be somewhat tedious and unnecessarily time-consuming.

Consider this: When you store some of your passwords on one device, some on another, and some in your browser (and probably a few in a notebook), not only do you introduce unnecessary complexity to accessing those passwords, but you also compromise their security. How so? Well, storing sensitive information in multiple locations increases the risk of unauthorized access and potential breaches.

What is the alternative? Using a password manager.

Sync your passwords and passkeys across all devices with NordPass

The optimal method for securely storing all your passwords in one convenient location is using NordPass, an advanced yet easy-to-use password manager that allows you to store, manage, and share passwords, credit card information, and personal data.

With its help, you can quickly autofill passwords and generate new ones as well as organize and categorize your credentials to your liking so that you can always access them easily and securely across all your devices.

Plus, as a modern platform that always keeps up with the times, NordPass facilitates passkey management, making it easy for you to enhance your cybersecurity and privacy.

So if you want to stop searching for guides on how to find your passwords on Mac, just use NordPass.

 

Frequently asked questions

How do you sync passwords between iPhone and Mac?

To sync passwords between your iPhone and Mac, you need to enable iCloud Keychain on both devices by accessing the iCloud settings. You need to confirm that both devices are using the same Apple ID, ensure they are connected to the internet, and keep the software updated. iCloud Keychain will then automatically synchronize your passwords across your devices.

How do you transfer passwords to a new Mac?

To transfer passwords to a new Mac, you need to make sure iCloud Keychain is enabled on the old Mac. Set up the new Mac using the same Apple ID and enable iCloud Keychain during the setup process. Your passwords should automatically sync to the new Mac, making them accessible for you on both devices.

How do you delete saved passwords on Mac?

First, locate the password you want to delete by following the process described above. Then, right-click on the password and select “Delete” from the context menu. Finally, confirm the deletion when prompted.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About NordPass
NordPass is developed by Nord Security, a company leading the global market of cybersecurity products.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

IT Support Levels: Optimizing the Support Service through Tiers 0 to 4

Information Technology (IT) support, also known as technical support, is essential for the successful and efficient operation of organizations in the digital age. It helps ensure the stability, productivity and security of your systems and those of the people who depend on them.

Its importance lies in several key aspects such as maintenance of the technological infrastructure (this includes servers, networks, operating systems, software, hardware and other essential components); and ensure business continuity, implement and maintain security measures (such as firewalls, antivirus and intrusion detection systems); periodic updating and maintenance of the software, implementation and management of data storage systems, backup and recovery of data in case of failures; resource optimization (such as server capacity management), keep up to date with the latest technological trends and evaluate how these can benefit the organization and provide data and analysis that help to decision-making.

Content:

The 5 levels of IT support: description, functions and skills

IT Support Level 0: Self-service

IT support level 0, often called “self-service,” is the initial level of technical support offered to users so they can solve technical problems on their own without needing to interact with a support technician. This tier support focuses on providing users with the tools, resources, and documentation needed to address common technical issues on your own. Some key aspects of IT Support Tier 0 include:

  • Self-service portal.
  • Knowledge base.
  • Guided self-service.
  • Online community.
  • Diagnostic tools.
  • Training.
  • Automation.

IT Support Level 1: First person-to-person contact (basic support)

Level 1 IT support, also known as “first person-to-person contact” or “basic support”, focuses on solving the simplest and most common technical problems that do not require advanced technical knowledge. Common features and responsibilities of tier 1 support are described below:

  • Helpdesk.
  • Incident logging and tracking.
  • Troubleshooting common problems.
  • Documentation and updating of the knowledge base.
  • Coordination with other teams.

IT Support Level 2: Technical support

IT Support Tier 2, also known as “technical support” or “advanced support”, handles more complex and technical issues that go beyond the capabilities of Tier 1. Some of the main features and responsibilities of tier support 2 are:

  • Root cause analysis.
  • Development and maintenance of technical documentation.
  • Interaction with suppliers and manufacturers.
  • Training and mentoring of level 1 staff.
  • Proactive monitoring and maintenance.
  • Participation in IT projects.

IT Support Level 3: Expert support

IT Support Level 3, also known as “expert support” or “high level support,” is responsible for addressing the most complex and challenging issues that require deep technical knowledge and expertise. The most outstanding features and responsibilities of tier support 3 are:

  • Research and development.
  • Design and implementation of advanced solutions.
  • Participation in strategic projects.
  • The development of policies and procedures.
  • Crisis management.

IT Support Level 4: Third Party Support

Level 4 IT support, also known as “third-party support” or “external support,” is reserved for extremely complex issues or situations where specialized expertise is required, which goes beyond what an organization can offer internally. Common features and responsibilities of tier support 4 are described below:

  • Technology vendor support.
  • Development of customized solutions.
  • Technology integration.
  • Participation in security audits and reviews.
  • Service contracts coordination and management.
  • Supplier relationship management.
  • Trend analysis and strategic recommendations.

Establishing a tiered help structure

Implementing a tiered support structure involves careful planning and execution to ensure efficient technical assistance. Among the main steps to establish a tiered help structure is the choice of the appropriate IT Service Management (ITSM) platform, which is scalable and customizable.

Once the ITSM tool has been chosen, a self-service platform or a dedicated web portal must be configured there and the IT support levels of the organization must be clearly defined. In addition, the ITSM platform must include process automation, such as ticket routing, incident prioritization or reporting; providing updated documentation at each support level; tools to measure the performance of the IT structure and demand management to plan workloads.

Finally, to create an effective structure it is essential to establish effective communication channels and perform periodic evaluations to adjust the structure and processes to the changing needs of the organization.

Conclusion

Implementing a tiered help structure in an IT environment brings multiple benefits to the organization.

Benefits of Implementing IT support levels

Support levels enable efficient distribution of support requests, ensuring that issues are addressed at the appropriate level for resolution. This operational efficiency results in an improvement of user satisfaction and in cost savings by ensuring that technical resources are used more competently.

On the other hand, quick management of critical incidents provided by the help structure by levels, escalating the problems according to their nature to the different levels of support, allows to guarantee the continuity of the business. Finally, sharing documentation and knowledge allows capacity building among company personnel.

Adapting the structure to the needs of the organization

It is important to note that there is no single and universally applicable IT levels support structure. Each organization has specific needs and requirements, so it is essential to adapt the structure to its particular circumstances taking into account the size and complexity of the organization, the nature of the operations, that it carries out according to the industry to which it belongs, the needs of the users, both internal and external, of the company; the economic and human resources that the organization has and the technological changes that take place and that require a flexible infrastructure capable of adapting to technological and business evolutions.

Frequently Asked Questions

Summary of frequent questions about IT support and careers in this field

What is IT support for?

IT support is a very useful tool, both for companies and individuals, to receive assistance in any of the tasks to be carried out in their corresponding IT environments. It guarantees that they will be able to meet their goals or continue to offer services to their customers even if they suffer hardware, software or network failures.

What are the IT support levels?

  • Level 0: Self-Service
  • Level 1: Basic support
  • Level 2: Technical support
  • Level 3: Expert support
  • Level 4: Third party support

How do I start my career in IT support?

Of course, to get a job in this field requires technical knowledge of systems and processes. To begin with, you could complete related courses or get one of the necessary certifications.

What is remote IT support?

Remote IT support allows support technicians to provide their services to customers more quickly and effectively through remote control, email or chat. Even at a distance, they are able to diagnose any problem and provide the steps to follow to solve it.

What are the skills to work in IT support?

Of course, dealing with clients will always require professional and effective communication skills. Additionally, the ability to effectively troubleshoot and keep up with all IT news is critical for any professional IT.

Expert in journalism and social networks, Laura writes technical articles specialized in technology, innovation and IT entrepreneurship. She also coordinates contents in TicPymes, a media specialized in SMEs and startups.

 
 

 

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About PandoraFMS
Pandora FMS is a flexible monitoring system, capable of monitoring devices, infrastructures, applications, services and business processes.
Of course, one of the things that Pandora FMS can control is the hard disks of your computers.

×

Hello!

Click one of our contacts below to chat on WhatsApp

Social Chat is free, download and try it now here!

×