Threat Intelligence
Silent Ledger: how a supply-chain lure reached crypto exchanges
A poisoned developer package and a fake recruiter persona gave the operators access to build systems at two exchanges.
/ 8 min read
In briefA poisoned developer package and a fake recruiter persona gave the operators access to build systems at two exchanges.
Silent Ledger operators posed as recruiters and asked engineers to complete a coding test that pulled a malicious package from a public registry.
Once installed, the package harvested cloud credentials and SSH keys from the developer machine and sent them to an attacker server.
Exchanges should require package pinning, review new dependencies, and keep signing keys off developer laptops entirely.
Filed under Security OperationsThreat Intelligence
Does this story affect you?
Tell us about your environment and a SentriXa security editor will get back to you within one business day.