Full Report
Cybersecurity researchers have exposed a previously unknown threat actor known as Water Curse that relies on weaponized GitHub repositories to deliver multi-stage malware. "The malware enables data exfiltration (including credentials, browser data, and session tokens), remote access, and long-term persistence on infected systems," Trend Micro researchers Jovit Samaniego, Aira Marcelo, Mohamed
Analysis Summary
This summary focuses *only* on the information available about **Water Curse** as described in the provided context. Information about ClickFix campaigns, AsyncRAT, Filch Stealer, and Sorillus/SambaSpy is excluded as it pertains to *other* actors or campaigns mentioned for comparative context, not the primary actor of interest derived from the initial description.
# Threat Actor: Water Curse
## Attribution & Identity
A previously unknown threat actor described as financially motivated. Believed to be engaging in a "broad and sustained" campaign that may have activities dating back to March 2023. As many as 76 GitHub accounts have been linked to their operation.
## Activity Summary
Water Curse delivers multi-stage malware via weaponized GitHub repositories masquerading as penetration testing utilities. The campaign was first spotted last month (relative to the article publication). The group's reported activities blend cybercrime with opportunistic monetization.
## Tactics, Techniques & Procedures
- Delivery via weaponized GitHub repositories, abusing trust in legitimate platforms (Software Supply Chain focus).
- Payloads are hidden within Visual Studio project configuration files.
- Uses obfuscated scripts written in Visual Basic Script (VBS) and PowerShell for complex multistage infection chains.
- Employs anti-debugging techniques.
- Utilizes privilege escalation methods.
- Implements persistence mechanisms for long-term foothold.
- Uses PowerShell scripts to weaken host defenses and inhibit recovery.
- Exfiltration via Telegram and public file-sharing services.
- Malicious repositories included diverse tools: SMTP email bomber, Sakura-RAT, game cheats, aimbots, cryptocurrency wallet tools, OSINT scrapers, spamming bots, and credential stealers.
- MITRE ATT&CK IDs: Not explicitly provided in the text.
## Targeting
- Sectors: Multi-vertical targeting strategy indicated by the diversity of delivered tools (e.g., credential theft suggests IT/Finance/General users).
- Geography: Not explicitly specified.
- Victims: Not specified, but targets likely include developers/organizations interacting with their GitHub repositories.
## Tools & Infrastructure
- **Malware families used:** SMTP email bomber, Sakura-RAT.
- **Infrastructure:** Weaponized GitHub repositories (as delivery mechanism), Telegram (for exfiltration), public file-sharing services (for C2/exfiltration).
## Implications
Water Curse represents a sophisticated supply chain threat actor leveraging developer trust in platforms like GitHub to distribute sophisticated malware with goals centered on credential theft and subsequent illicit access resale. Their goal is financial gain through data exfiltration and session hijacking.
## Mitigations
- Scrutinize Visual Studio project configuration files delivered from external or untrusted sources.
- Monitor for the use of VBS and encoded PowerShell scripts post-initial execution.
- Enhance endpoint detection capabilities against anti-debugging and privilege escalation techniques.
- Monitor for active data exfiltration to Telegram or uncommonly used public file-sharing services.