Threat Intelligence Roundup: Defending Against Miasma npm Worm and Gafgyt C0XMO

---
title: Potential Malicious npm Build Process - Miasma Worm
id: 8a4b2c9d-1e3f-4a5b-8c6d-7e8f9a0b1c2d
status: experimental
description: Detects suspicious child processes spawned by npm or node-gyp during package installation, indicative of malicious binding.gyp scripts like Miasma.
references:
  - https://securityaffairs.com/193609/breaking-news/security-affairs-malware-newsletter-round-101.html
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.004
  - attack.initial_access
  - attack.t1199.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - '\node.exe'
      - '\npm.cmd'
      - '\node-gyp'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\bash.exe'
  condition: all of selection_*
falsepositives:
  - Legitimate build scripts requiring shell access (rare)
level: high
---
title: Gafgyt C0XMO Botnet Download Pattern
id: 9b5c3d0e-2f4a-5b6c-9d7e-0f1a2b3c4d5e
status: experimental
description: Detects common Gafgyt C0XMO download and execution patterns involving wget/curl followed by chmod.
references:
  - https://securityaffairs.com/193609/breaking-news/security-affairs-malware-newsletter-round-101.html
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1105
logsource:
  category: process_creation
  product: linux
detection:
  selection_download:
    CommandLine|contains:
      - 'wget'
      - 'curl'
  selection_perms:
    CommandLine|contains:
      - 'chmod 777'
      - 'chmod +x'
  selection_exec:
    CommandLine|matches: '\./[a-zA-Z0-9]{6,}'
  condition: all of selection_*
falsepositives:
  - Administrator manual software installation
level: medium

// Hunt for Miasma indicators: npm spawning shells
DeviceProcessEvents
| where InitiatingProcessFileName in ('npm.exe', 'node.exe', 'node-gyp.cmd', 'node-gyp')
| where FileName in ('powershell.exe', 'cmd.exe', 'bash.exe', 'sh')
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, CommandLine, FileName
| order by Timestamp desc

-- Hunt for suspicious binding.gyp files in node_modules that may contain Miasma payloads
SELECT FullPath, Size, Mtime, Mode
FROM glob(globs='/*/node_modules/*/binding.gyp')
-- Check if the file size is unusually small or large for a gyp file, or recently modified
WHERE Mtime > now() - 7d

-- Hunt for Gafgyt C0XMO processes (often associated with specific binary names or high CPU)
SELECT Pid, Name, Exe, Ctime, Username, CommandLine
FROM pslist()
WHERE Name =~ 'busybox'
   OR Exe =~ '/tmp/'
   OR Exe =~ '/dev/shm/'
   AND CommandLine =~ '(wget|curl|tftp)'

#!/bin/bash
# Remediation script for Miasma (ai-sdk-ollama) and basic Gafgyt hardening

echo "[*] Scanning for malicious ai-sdk-ollama package..."
# Find all package. files and check for the dependency
find /home /root /usr/local/lib -name "package." -exec grep -l "ai-sdk-ollama" {} \; 2>/dev/null | while read file; do
    DIR=$(dirname "$file")
    echo "[!] Found ai-sdk-ollama in $DIR"
    # Remove the malicious package
    cd "$DIR" && npm uninstall ai-sdk-ollama --force
    echo "[*] Removed package from $DIR"
done

echo "[*] Checking for suspicious binding.gyp content..."
# Look for base64 encoded strings or direct shell execution attempts in gyp files
find /node_modules /home/*/node_modules -name "binding.gyp" -exec grep -l "sh.exec" {} \; 2>/dev/null

echo "[*] Hardening against Gafgyt C0XMO propagation..."
# Block common inbound ports used by Gafgyt (Telnet) if not needed
# (Requires root/sudo)
if [ "$EUID" -eq 0 ]; then
    echo "[*] Ensuring Telnet is disabled..."
    systemctl disable telnet.socket 2>/dev/null
    systemctl stop telnet.socket 2>/dev/null
else
    echo "[!] Root privileges required to disable Telnet services."
fi

echo "[+] Remediation check complete."