Ethersphere bee-js: Wallet-Stealing Malware via Backdoor

At-A-Glance Incident Diagnostic Telemetry

Diagnostic Metric	Operational Telemetry & Defense Status
Advisory Authority	CyberNewsAI Threat Intelligence & Incident Response Directorate
Threat Severity Rating	MEDIUM (CVSS v3.1: 5.5 / Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)
Exploitation Activity	🟢 NO KNOWN IN-THE-WILD EXPLOITATION DETECTED
Remediation State	OFFICIAL VENDOR PATCH AVAILABLE (Deploy Immediately)
CISA KEV Catalog	MONITORED FOR CISA KEV CATALOG INGESTION
Targeted Perimeter	Hardware Security Modules (HSM) & Offline Key Storage
Continuous Monitoring	ACTIVELY MONITORED // Telemetry Verified: 2026-11-10

---

Executive Incident Briefing (2-Minute CISO Brief)

1. Strategic Incident Overview

Ethersphere's bee-js 13.3.0 and Swarm Desktop 0.56.2 releases were compromised by attackers using stolen CI credentials and secrets. The malicious releases downloaded and ran code to steal wallet keys, install backdoors, and send sensitive data to attackers' servers. The payloads shared an Ethereum contract, a ScreenConnect relay, and file names with fake extensions for Solidity developers. The incident highlights the importance of secure CI/CD pipelines and code review processes.

The attackers used the Ethersphere project's own release automation to publish the malicious releases. The bee-js package is the JavaScript library behind Swarm Desktop and the swarm-cli command-line tool. The malicious releases were taken down, and a clean Swarm Desktop update was released. However, the backdoor already installed and the key already sent remain a concern.

Defenders can search logs and machines for the following indicators: the presence of the evjawbreaker Go remote shell on Linux and macOS, the ScreenConnect remote-access client on Windows, and the fake Solidity file extensions.

2. Business Impact & Perimeter Exposure

The incident highlights the importance of secure CI/CD pipelines and code review processes. The attackers used the Ethersphere project's own release automation to publish the malicious releases. The bee-js package is the JavaScript library behind Swarm Desktop and the swarm-cli command-line tool. The malicious releases were taken down, and a clean Swarm Desktop update was released. However, the backdoor already installed and the key already sent remain a concern.

The incident may have a significant impact on the business, as it highlights the importance of secure CI/CD pipelines and code review processes. The attackers used a known way around the User Account Control prompt to get administrator rights on Windows. They also installed a Microsoft Defender exclusion and installed the ScreenConnect client silently.

3. Compliance & Governance Blast Radius

The incident may trigger regulatory compliance requirements, such as CISA KEV/BOD, GDPR Art. 33, NIS2, SEC 8-K, and HIPAA.

---

Technical Vulnerability Analysis & Attack Chain

Root-Cause & Exploitation Mechanics

The payloads shared an Ethereum contract, a ScreenConnect relay, and file names with fake extensions for Solidity developers. The attackers used a known way around the User Account Control prompt to get administrator rights on Windows. They also installed a Microsoft Defender exclusion and installed the ScreenConnect client silently.

The incident highlights the importance of secure CI/CD pipelines and code review processes. Defenders can search logs and machines for the following indicators: the presence of the evjawbreaker Go remote shell on Linux and macOS, the ScreenConnect remote-access client on Windows, and the fake Solidity file extensions.

Adversary Ingress & Lateral Traversal Pipeline

The attackers used a known way around the User Account Control prompt to get administrator rights on Windows. They also installed a Microsoft Defender exclusion and installed the ScreenConnect client silently. The incident highlights the importance of secure CI/CD pipelines and code review processes.

---

MITRE ATT&CK Tactics, Techniques & Procedures (TTPs)

MITRE ATT&CK • OPERATIONAL TTP MAPPING

Tactic	Technique ID	Technique Name	Operational Context
Initial Access	T1190	Exploit Public-Facing Application	Remote zero-day / N-day exploitation of edge devices
Execution	T1203	Exploitation for Client Execution	Malicious code execution within target process context
Defense Evasion	T1027	Obfuscated/Compressed Payloads	Ephemeral memory-resident binaries and anti-forensics
Command and Control	T1071.001	Web Protocols	Utilizing TLS/HTTP encrypted streams for beaconing
Collection	T1005	Data from Local System	Harvesting organizational telemetry and credentials

---

Threat Actor Profile & Exploitation Telemetry

The attackers are believed to be the same group behind the original SleepyDuck extension, which read its server address from a different Ethereum contract in 2025. The group is also tied to the fake Solidity file extensions that appeared on the Open VSX marketplace in September. The attackers used stolen CI credentials and secrets to publish the malicious releases.

---

Detection & SOC Mitigation Playbook

1. Patch Deployment & Workaround Engineering

Review official vendor security bulletins and deploy released security hotfixes across all production and staging environments immediately.

2. Network & Perimeter Defenses

Restrict administrative ingress to dedicated, non-routable management subnets requiring hardware MFA.
Enforce strict egress inspection to drop outbound connection attempts to unauthorized public IP space.

3. Verification & Diagnostic Audit Checklist

Incident Response Checklist

Search logs for the presence of the evjawbreaker Go remote shell on Linux and macOS
Search logs for the presence of the ScreenConnect remote-access client on Windows
Search for fake Solidity file extensions on machines
Verify that the Microsoft Defender exclusion has been removed
Verify that the ScreenConnect client has been uninstalled
Replace Linux packages with the clean version of Swarm Desktop
Update Swarm Desktop to the latest version
Review CI/CD pipelines and code review processes to ensure they are secure
Consider implementing additional security measures, such as code signing and notarization

---

Indicators of Compromise (IOCs)

No specific binary hashes were published in the authoritative advisory; hunt using behavioral telemetry and detection rules above.

---

Frequently Asked Questions (FAQ)

1. Is Ethersphere bee-js actively exploited in the wild?

While no mass exploitation has been publicly observed to date, the severity of the flaw warrants urgent patch deployment ahead of weaponization.

2. Which systems, applications, and perimeters are affected?

The vulnerability primarily impacts Ethersphere bee-js installations exposed to public-facing internet traffic or unauthenticated internal network segments.

3. What immediate remediation or patch should organizations deploy today?

Deploy the official security hotfixes released by the vendor immediately. If patching cannot be completed today, implement network ingress restrictions and isolate management interfaces.

4. How can security operations teams detect and hunt for this threat?

Defenders should monitor process creation logs for abnormal shell executions under web servers (e.g. bash, powershell under nginx/httpd) using the provided Sigma rule and Microsoft Sentinel KQL query.