DORA-Art23-P1

<?xml version="1.0" encoding="UTF-8"?>
<CyberThreatNotification
    notificationId="CTN-2025-003"
    institution="Nordvik Bank AG"
    submissionDate="2025-01-22"
    notificationType="Voluntary"
    regulatoryBasis="DORA Article 23">

  <!-- ═══════════════════════════════════════════════════════════════════════
       NOTIFICATION HEADER
       Voluntary cyber threat notification per DORA Article 23
       ═══════════════════════════════════════════════════════════════════════ -->
  <NotificationHeader>
    <SubmittedBy>Katrin Halvorsen, CISO</SubmittedBy>
    <SubmittedTo>FINMA — Cyber Threat Intelligence Unit</SubmittedTo>
    <ContactEmail>ciso@nordvik-bank.example</ContactEmail>
    <ContactPhone>+41 44 XXX XXXX</ContactPhone>
    <ThreatDiscoveryDate>2025-01-20</ThreatDiscoveryDate>
    <ConfidentialityMarking>TLP:AMBER</ConfidentialityMarking>
  </NotificationHeader>

  <!-- ═══════════════════════════════════════════════════════════════════════
       THREAT DESCRIPTION
       ═══════════════════════════════════════════════════════════════════════ -->
  <ThreatDescription>
    <ThreatType>supply_chain</ThreatType>
    <ThreatSeverity>high</ThreatSeverity>
    <ThreatName>Compromised NPM Package in Digital Banking Dependency Chain</ThreatName>
    <Description>
      On 20 January 2025, the Bank's application security team identified a
      compromised NPM package (event-stream-utils v2.4.1) in the dependency
      chain of the digital banking platform's transaction notification service.
      The compromised package was published on 18 January 2025 and contained
      obfuscated code designed to exfiltrate environment variables (including
      potential API keys and database connection strings) to an external
      command-and-control server.

      The Bank's software composition analysis (SCA) tool flagged the package
      during the scheduled weekly dependency scan on 20 January. Investigation
      confirmed that the compromised version was present in the development
      environment but had NOT been deployed to production. The Bank's change
      freeze policy (active until 13 January) and the subsequent release
      approval process prevented the compromised dependency from reaching
      production systems.

      The threat appears to target financial institutions using the popular
      event-stream ecosystem of NPM packages. The attack vector is consistent
      with the supply chain compromise techniques attributed to threat actors
      targeting the European financial sector in H2 2024.
    </Description>
    <ThreatActorAttribution>Unknown — consistent with financially motivated supply chain actors</ThreatActorAttribution>
    <ProductionImpact>false</ProductionImpact>
  </ThreatDescription>

  <!-- ═══════════════════════════════════════════════════════════════════════
       INDICATORS OF COMPROMISE
       ═══════════════════════════════════════════════════════════════════════ -->
  <IndicatorsOfCompromise count="5">
    <IOC iocId="IOC-001" type="Package">
      <Value>event-stream-utils@2.4.1 (NPM)</Value>
      <Description>Compromised NPM package containing obfuscated exfiltration code</Description>
      <FirstSeen>2025-01-18</FirstSeen>
      <Confidence>High</Confidence>
    </IOC>
    <IOC iocId="IOC-002" type="SHA256">
      <Value>a3f8b2c1d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1</Value>
      <Description>SHA-256 hash of compromised package tarball</Description>
      <FirstSeen>2025-01-18</FirstSeen>
      <Confidence>High</Confidence>
    </IOC>
    <IOC iocId="IOC-003" type="Domain">
      <Value>cdn-analytics-pkg.example.net</Value>
      <Description>Command-and-control domain for data exfiltration</Description>
      <FirstSeen>2025-01-17</FirstSeen>
      <Confidence>High</Confidence>
    </IOC>
    <IOC iocId="IOC-004" type="IP">
      <Value>198.51.100.42</Value>
      <Description>IP address hosting C2 infrastructure</Description>
      <FirstSeen>2025-01-17</FirstSeen>
      <Confidence>Medium</Confidence>
    </IOC>
    <IOC iocId="IOC-005" type="Behaviour">
      <Value>POST requests to /api/v1/telemetry containing base64-encoded environment variables</Value>
      <Description>Exfiltration behaviour pattern observed in sandbox analysis</Description>
      <FirstSeen>2025-01-20</FirstSeen>
      <Confidence>High</Confidence>
    </IOC>
  </IndicatorsOfCompromise>

  <!-- ═══════════════════════════════════════════════════════════════════════
       POTENTIAL IMPACT ASSESSMENT
       ═══════════════════════════════════════════════════════════════════════ -->
  <PotentialImpactAssessment>
    <ImpactIfUndetected>
      If the compromised package had been deployed to production, the attacker
      could have obtained database connection strings, API keys for third-party
      services, and internal service credentials from the transaction notification
      service's runtime environment. This could have enabled unauthorised access
      to customer transaction data and potentially allowed manipulation of
      notification delivery.
    </ImpactIfUndetected>
    <ActualImpact>
      No production impact. The compromised package was confined to the
      development environment. Development environment credentials are isolated
      from production and have been rotated as a precautionary measure.
    </ActualImpact>
    <AffectedSector>Financial services — specifically institutions using NPM-based digital banking platforms</AffectedSector>
    <EstimatedInstitutionsAtRisk>Medium — the event-stream ecosystem is widely used in financial services web applications</EstimatedInstitutionsAtRisk>
  </PotentialImpactAssessment>

  <!-- ═══════════════════════════════════════════════════════════════════════
       RECOMMENDED MITIGATIONS
       ═══════════════════════════════════════════════════════════════════════ -->
  <RecommendedMitigations>
    <Mitigation mitigationId="MIT-001" priority="Immediate">
      <Description>Block the compromised package version (event-stream-utils@2.4.1) in all package registries and lock files</Description>
      <Applicability>All institutions using NPM-based applications</Applicability>
    </Mitigation>
    <Mitigation mitigationId="MIT-002" priority="Immediate">
      <Description>Block network traffic to cdn-analytics-pkg.example.net and 198.51.100.42 at firewall and DNS level</Description>
      <Applicability>All institutions</Applicability>
    </Mitigation>
    <Mitigation mitigationId="MIT-003" priority="High">
      <Description>Scan all NPM dependency trees for the compromised package using SCA tools</Description>
      <Applicability>All institutions using NPM-based applications</Applicability>
    </Mitigation>
    <Mitigation mitigationId="MIT-004" priority="High">
      <Description>Rotate all credentials and API keys in environments where the compromised package was installed</Description>
      <Applicability>Institutions where the package was present in any environment</Applicability>
    </Mitigation>
    <Mitigation mitigationId="MIT-005" priority="Medium">
      <Description>Review and tighten NPM package approval processes — consider using a private registry with manual approval for new dependencies</Description>
      <Applicability>All institutions with NPM-based development</Applicability>
    </Mitigation>
  </RecommendedMitigations>

</CyberThreatNotification>

{
  "factId": "b1c2d3e4-f5a6-7890-abcd-200000000011",
  "evidenceId": "a0b1c2d3-e4f5-6789-abcd-200000000011",
  "evidenceClassId": "cyber-threat-notification",
  "factType": "cyber_threat_notification_status",
  "data": {
    "notification_date": "2025-01-22",
    "threat_type": "supply_chain",
    "threat_severity": "high",
    "has_indicators_of_compromise": true,
    "ioc_count": 5,
    "potential_impact_assessed": true,
    "mitigations_recommended": true,
    "shared_with_community": false
  },
  "provenance": "provisional",
  "extractorVersion": "dora-test-generator/0.1.0",
  "extractedAt": "2025-02-15T09:00:00Z",
  "supersededBy": null
}