SleepyDuck Supply Chain Attack: Malicious VSX Extension Exposes Developers via Ethereum C2
Executive Summary
In late October and early November 2025, cybersecurity researchers uncovered a malicious Visual Studio Code extension, 'juan-bianco.solidity-vlang', uploaded to the Open VSX registry. Originally benign, the extension was updated within days to include a remote access trojan called SleepyDuck, which leveraged Ethereum smart contracts to dynamically maintain connectivity with its command-and-control (C2) servers. By exploiting the trust inherent in open-source software supply chains and masquerading as a development tool, attackers enabled remote access and possible data exfiltration from developer environments, posing significant risks to organizations reliant on open-source packages.
This breach highlights the persistent threat of supply chain attacks targeting developer tools and marketplaces, a rapidly growing vector as attackers seek to compromise software upstream. It also demonstrates the adoption of blockchain infrastructure for resilient, hard-to-takedown C2 mechanisms, forcing defenders to adapt to increasingly complex threat ecosystems.
Why This Matters Now
As organizations accelerate cloud and open-source adoption, the use of trusted registries exposes new supply chain risks. SleepyDuck’s use of Ethereum for C2 agility makes detection and takedown more difficult, underscoring the urgency of validating third-party code and bolstering controls around developer environments before attackers exploit these weak links.
Attack Path Analysis
The attackers initiated compromise by introducing a malicious VSX extension ('SleepyDuck') via the Open VSX registry, leveraging a supply chain channel to gain execution within developer environments. Once inside, the trojan sought elevated privileges through application-level abuse or access token theft. The malware attempted lateral movement by scanning and pivoting within cloud or containerized infrastructure to maximize its footprint. Command and control was maintained using encrypted outbound connections, including Ethereum-based mechanisms to orchestrate and update the C2 infrastructure. Data exfiltration and sensitive material theft were facilitated over covert or allowed egress channels. Finally, the attack aimed to establish persistence, enable further compromise, or prepare for ransomware or disruptive operations.
Kill Chain Progression
Initial Compromise
Description
Attackers distributed a malicious Visual Studio Code extension via the Open VSX registry, which was installed by unsuspecting users and provided initial access.
MITRE ATT&CK® Techniques
Supply Chain Compromise
Compromise Client Software Binary
Signed Binary Proxy Execution
Event Triggered Execution: VS Code Extensions
Application Layer Protocol: Web Protocols
Ingress Tool Transfer
Masquerading
Command and Scripting Interpreter
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Change and Vulnerability Management Processes
Control ID: 6.4.2
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA (EU Regulation 2022/2554) – ICT Risk Management Framework
Control ID: Article 6
CISA Zero Trust Maturity Model (ZTMM) 2.0 – Software Supply Chain Security
Control ID: Pillar: Applications - Control: Software Supply Chain Security
NIS2 Directive – Supply Chain Security Measures
Control ID: Article 21(2)
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer Software/Engineering
VSX extension supply chain attack targets developer environments, compromising code integrity through malicious extensions with encrypted C2 communications via Ethereum blockchain.
Information Technology/IT
SleepyDuck trojan exploits development tool trust relationships, enabling lateral movement and data exfiltration across IT infrastructure through compromised developer workstations.
Financial Services
Ethereum-based command server creates persistent threat vector for financial institutions using affected development tools, risking sensitive data exposure and regulatory compliance violations.
Computer/Network Security
Supply chain compromise demonstrates advanced evasion techniques using blockchain infrastructure, challenging traditional security controls and requiring enhanced threat detection capabilities.
Sources
- Malicious VSX Extension "SleepyDuck" Uses Ethereum to Keep Its Command Server Alivehttps://thehackernews.com/2025/11/malicious-vsx-extension-sleepyduck-uses.htmlVerified
- Malicious VSX Extension 'SleepyDuck' Leverages Ethereum for Command and Controlhttps://cyberwarzone.com/2025/11/04/malicious-vsx-extension-sleepyduck-leverages-ethereum-for-command-and-control/Verified
- Malicious VSX Extension 'SleepyDuck' Found-Trojan Uses Ethereum Blockchain as Backup Command Channelhttps://www.thaicert.or.th/en/2025/11/05/malicious-vsx-extension-sleepyduck-found-trojan-uses-ethereum-blockchain-as-backup-command-channel/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Zero Trust segmentation, east-west workload controls, comprehensive egress policy enforcement, and real-time threat detection would have limited the malicious extension's ability to spread, communicate with its C2 infrastructure, and exfiltrate data. These controls minimize attack surface, constrain lateral movement, and provide early visibility and blocking of unauthorized or anomalous behavior.
Control: Threat Detection & Anomaly Response
Mitigation: Early detection of anomalous extension behavior and alerting on unauthorized executable activity.
Control: Zero Trust Segmentation
Mitigation: Constrained privilege pathways prevent unauthorized elevation and limit scope of access.
Control: East-West Traffic Security
Mitigation: Internal lateral movement is identified and blocked, limiting the attacker's ability to pivot.
Control: Egress Security & Policy Enforcement
Mitigation: Unauthorized C2 connections—especially those to novel domains or blockchain endpoints—are blocked or flagged.
Control: Encrypted Traffic (HPE)
Mitigation: Data exfiltration attempts are detected, logged, and can be disrupted at line rate.
Full audit trails and rapid response limit dwell time and downstream impact.
Impact at a Glance
Affected Business Functions
- Software Development
- Blockchain Development
Estimated downtime: 3 days
Estimated loss: $500,000
Potential exposure of sensitive system information, including hostname, username, MAC address, and timezone, to unauthorized remote servers.
Recommended Actions
Key Takeaways & Next Steps
- • Enforce Zero Trust Segmentation and least privilege access to isolate workloads and prevent privilege escalation from compromised extensions.
- • Apply granular east-west traffic policies to block unauthorized lateral movement between cloud workloads and container resources.
- • Implement strict egress filtering with FQDN and protocol controls to prevent malicious Command & Control and data exfiltration.
- • Deploy distributed threat detection and anomaly response solutions to identify and contain suspicious extensions or remote access tools in real time.
- • Maintain continuous multicloud visibility and central policy management to enable rapid incident response and minimize time to remediation.
