A lot of folks have reached out about Socket's recent report on a supply chain attack using malicious NuGet packages to target Siemens S7 protocol and other PLCs.
This is not a supply chain attack in the traditional sense. No legitimate projects were compromised, and no S7, Sharp7, or Siemens codebases were modified. Socket identified packages published by a separate user ("shanhai666") containing code that probabilistically kills host processes and causes database write failures within specific date ranges.
While I agree the code is harmful and the packages are suspicious, I'm not convinced about the supply chain attack angle -- or if it is one, it's not a particularly effective one. Several factors give me pause:
- The lure isn't particularly convincing.
- The packages are unpopular (even by Socket's metrics), so infection of new projects seems improbable.
- It's unclear how or why existing projects that use legit Sharp7 or SQL would switch to the malicious dependency.
- There's no C2 code or infrastructure to confirm victims. How would an attacker even know if this worked?
- The evidence doesn't clearly rule out the alternative explanation of offensive security research.
I'd give this a low confidence assessment for malicious intent. That said, it's normal for analysts to reach different conclusions based on the same data, and my assessment isn't a criticism of Socket's solid technical analysis and code breakdown.
Props to their Threat Research team for identifying and publicizing these harmful packages. If you want to understand what the code does, check out their post. Their package search tool also has a neat decompilation feature that lets you examine the code yourself.
Bottom line: Always verify your dependencies and their sources!
https://socket.dev/blog/9-malicious-nuget-packages-deliver-time-delayed-destructive-payloads
