SentinelOne SDK malvertised by Pypi Package

Researchers have discovered a new malicious package named SentinelOne on the PyPI repository impersonating a legitimate software development kit for SentinelOne.

The package is part of the malicious campaign called SentinelSneak. The package claims to provide access the SentinelOne’s APIs, but it contains malicious code to harvest sensitive info from development systems, including credentials, configuration data, and SSH keys.

As per researchers, the package is a replica of the actual SentinelOne SDK python client. The threat actor added the malicious functionality to its code. Threat actors behind the SentinelSneak campaign also released two additional packages, named SentinelOne-sdk and SentinelOneSDK, with similar functionalities.

The fake SentinelOne package contains api.py files that contain the code to steal and exfiltrate data, uploading it to the IP address 54.254.189.27.

The analysis of the changes between the versions of the malicious module revealed that threat actors modified it to improve the data collection algorithm and make it work on multiple platforms.

Threat actors published five additional malicious packages with a similar name, these modules did not contain api.py files with malicious functionality, a circumstance that suggests they were used for testing purposes.

The experts discovered that the malicious versions of the package have been downloaded over 1,000 times on PyPI.

The packages were published between December 8th and 11th, 2022. Findings were reported to the PyPI on December 15th, 2022, and SentinelOne was notified on December 16th, 2022.

This research was documented by researchers from ReversingLabs.

Indicators of Compromise

• 68b09896b65db21d2c6cd2923d2486a2f69f73ef
• 557af28f0a42d4fb7466376ce422bcb518e7ccc0
• 1378d35524804d2f0e42fc1e8e6365211713731f
• 268546ab1aedee336151933159f056c45844ef4c
• 3859aa3ddc941be0d8459b90244f7cb0f48da1be
• 3eaa0ced4d19742c35bc3d9a99636e5333ceb573
• 94f6ba66169f54975771d6201bd8a40a65ffee16
• 9e0373a8e50a1a87a552cd25cfdad51322b00719
• 3c4d2e0f3125817c10ae4aa4a29a8ddcedbe3065
• f8438699804645ebc7cc573cc1326050814b02e4
• 661450bd7934ae7a138a040d9d27b086414237d3
• de2a6dfbed323e0109ce02737df1d9ce5de38561
• 1a891771806974ec18111a6c69b6d5bb92d6298d
• a219cec2f4a3ea2c2a707925473ebe68b620e75c
• 5d843c53ef47ef89a1ab4a8d2e58bb9c2ae6bf34
• bc890c4578ba52a27902c4b6e2bfe0c18ca84a2d