Props to the author of the malware — not for executing a supply chain attack, but for making malware that’s not obvious to detect when running. It snags only 1000 files in HOME, only those less than 100k, and then caps it off by uploading via DNS.

I hate to “give props” to the bad guy, but as a former pentester this area is fascinating. The cat and mouse game is eternal, and both sides evolve. This malware is pretty standard, but it’s also smart — you can tell it was developed by a dev to target devs.

Any progress on blocking exfiltration via DNS? It seems only malicious programs make heavy queries like this, and it should be detectable. Even a small ML network could probably be trained to tell the difference between legit queries and malware uploads.