Malicious Laravel Packages on Packagist Deploy RAT on Windows, macOS, and Linux
Cybersecurity researchers have uncovered a concerning issue with malicious PHP packages on Packagist, a popular repository for PHP packages. These packages, disguised as Laravel utilities, are actually conduits for a cross-platform remote access trojan (RAT) that can operate on Windows, macOS, and Linux systems. The names of the packages are as follows:
- nhattuanbl/lara-helper (37 Downloads)
- nhattuanbl/simple-queue (29 Downloads)
- nhattuanbl/lara-swagger (49 Downloads)
According to Socket, the package 'nhattuanbl/lara-swagger' doesn't directly embed malicious code, but it lists 'nhattuanbl/lara-helper' as a Composer dependency, causing it to install the RAT. These packages are still available for download from the PHP package registry. Both 'lara-helper' and 'simple-queue' contain a PHP file named 'src/helper.php' that employs various techniques to complicate static analysis, such as control flow obfuscation, encoding domain names, command names, and file paths, and randomized identifiers for variable and function names.
Once loaded, the payload connects to a C2 server at helper.leuleu[.]net:2096, sends system reconnaissance data, and waits for commands, giving the operator full remote access to the host. The RAT supports a range of commands, including sending system information, parsing commands received from the C2 server for execution, and more. The communication occurs over TCP using PHP's streamsocketclient() function.
Security researcher Kush Pandya noted that the RAT probes 'disablefunctions' and picks the first available method from 'popen', 'procopen', 'exec', 'shell_exec', 'system', and 'passthru'. This makes it resilient to common PHP hardening configurations. While the C2 server is currently non-responsive, the RAT is configured to retry the connection every 15 seconds in a persistent loop, posing a significant security risk.
Users who have installed these packages are advised to assume compromise, remove them, rotate all secrets accessible from the application environment, and audit outbound traffic to the C2 server. The threat actor behind these packages has also published three other libraries ('nhattuanbl/lara-media', 'nhattuanbl/snooze', and 'nhattuanbl/syslog') that are clean, likely in an effort to build credibility and trick users into installing the malicious ones.
Socket warns that any Laravel application that installed 'lara-helper' or 'simple-queue' is running a persistent RAT, giving the threat actor full remote shell access, the ability to read and write arbitrary files, and ongoing system profiling for each connected host. The RAT runs in the same process as the web application with the same filesystem permissions and environment variables, including database credentials, API keys, and .env contents.
For more exclusive content, follow us on Google News, Twitter, and LinkedIn.
