Detecting SourTrade: Hunting for In-Browser Payload Assembly via Bun
Has anyone encountered indicators related to the SourTrade campaign reported by Confiant? The mechanism of using a legitimate Bun runtime to assemble the payload client-side is a significant shift in tradecraft. By fragmenting the malicious payload and fetching it in pieces, they effectively bypass standard static analysis and 'single file download' heuristics that most endpoint solutions rely on.
Since this targets retail traders impersonating platforms like TradingView and Solana, the initial infection vector is malvertising, making network filtering difficult. I'm particularly interested in how we can detect the assembly phase on the endpoint. The victim's browser is essentially building the Windows executable using Bun.
I'm currently working on a detection logic focusing on the Bun process spawning or writing suspicious files. Here is a basic Sigma rule concept I'm testing to flag Bun performing unexpected actions:
title: Suspicious Bun Runtime Payload Assembly
status: experimental
description: Detects bun.exe writing executables or spawning shells
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: '\bun.exe'
Image|endswith:
- '\powershell.exe'
- '\cmd.exe'
condition: selection
falsepositives:
- Legitimate developer activity
level: high
Has anyone else seen this in the wild? Are you relying on EDR behavioral detection, or are you blocking the Bun runtime entirely in user environments? Given that it targets finance/trading verticals, software restriction policies might be the only sure bet.
We haven't seen SourTrade specifically, but we've started blocking non-developer workstations from running bun.exe via AppLocker. Since the targets here are retail traders, there is virtually no legitimate reason for them to have a JavaScript toolkit like Bun installed. It's a blunt instrument, but it completely neutralizes this specific vector. If a dev needs it, they can submit a ticket.
From a SOC perspective, look for the specific network behavior. The fragments are likely pulled from distinct ad-tech domains or CDNs rather than the malicious domain itself. You might try correlating high-frequency HTTP requests from a single browser session that result in memory spikes in the renderer process. The 'assembly' action might trigger browser sandbox warnings depending on how they're writing the file to disk.
The use of Bun is clever because it's a signed, legitimate binary, so certificate validation won't help. I'd suggest adding a hunting query for bun.exe processes that have a parent process of a web browser (Chrome, Edge, Firefox). That should be a massive red flag, as Bun is typically a CLI tool invoked by a user or terminal, not a browser child process.
Verified Access Required
To maintain the integrity of our intelligence feeds, only verified partners and security professionals can post replies.
Request Access