Dark Side of VSCode~ How Attacker Abuse VSCode as RAT ~Hayate Hazuru, Shuhei Sasada
ITOCHU Cyber & Intelligence

1Agenda

01 Introduction
02 What is VSCode03 What is Remote Development
04 Artifacts
05 Detection and Protection
06 Conclusion
Projection Only / TLP:RED

ITOCHU Cyber & Intelligence Inc.

2

01 Introduction
ITOCHU Cyber & Intelligence Inc.

3

Attacks overview and talk focus
focus
Operation<fake gift information>
Spear-Phishing Email
Sign inC2 Server

Tropic Trooper
Operation

BLOB

Download
PhishingsiteCommunication

Downloader

LegitimateSide-Load<in memory>
RATOpen decoyPDF
ITOCHU Cyber & Intelligence Inc.

Microsoft Server

Install

VSCode CLI
VSCode ServerTunnel

4Attacks overview and talk focus
focus• The targeted attack was observed in late September 2023.

• VSCode abuse has been a long-standing concern, but
this is the first confirmed
Operationcase of APT abuse.

<fake gift information>
Communication
Tropic Trooper•
Attackers
usedacombinationofRATandVSCodetunnels
tocompromise
PCs
Spear-Phishing EmailC2 Server
throughtwo routes.
Operation
Sign inBLOB• For complete details on Tropic Trooper(alias:PiratePanda, KeyBoy) attack campaigns, please refer tothe Download
VB2023 London lecture material. (UnveilingSide-Load
Activities of Tropic Trooper
2023: Deep Analysis <in memory>
Downloader
Phishingfor Xiangoop Loader and EntryShell payload)site
RAT
Legitimate

Open decoy

PDF
ITOCHU Cyber & Intelligence Inc.

Microsoft Server

Install

VSCode CLI
VSCode Server

Tunnel5

02 What is VSCode
ITOCHU Cyber & Intelligence Inc.

6

What is the Visual Studio Code (VSCode)• VSCode is a code editor released by Microsoft in April 2015 (andOSS).
• It is extremely multifunctional and offers useful extensions
provided by official, third-party vendors, and communities.
• Today, VSCode has become a standard in modern development,
marking an end to the "editor wars".

ITOCHU Cyber & Intelligence Inc.

7

03 What is Remote Development
ITOCHU Cyber & Intelligence Inc.

8

VS Code Remote Development●

Why we use remote development feature
○
○

○
○

●

Development on an operating system different from the host.
Utilization of standardized or pre-built development environments.
Isolation of the development environment from the host (also as protection against
malicious packages/extensions).
Development on a more powerful host.

How Remote Development works
1.
2.
3.

Connect to a remote host using methods such as SSH or tunneling.
The "VS Code Server" is deployed on the remote host.
By connecting from the developer's VSCode (Web/Standalone) on their device,
they can edit source code on the remote host and execute commands.

VS Code Remote Development - Mirosoft

ITOCHU Cyber & Intelligence Inc.

9

How dev tunnels work
Authentication using either a Github, Microsoft ID, or Entra ID
establishes a connection with Microsoft's tunnel server (devtunnels).
2. An endpoint corresponding to the Phase 1 connection is created.
3. Connect to the created endpoint using VSCode.
1.

dev tunnels(hosted by microsoft)

Remote HostDeveloperDevice

ITOCHU Cyber & Intelligence Inc.

10

demo

ITOCHU Cyber & Intelligence Inc.

11

Projection Only / TLP:RED

04 Artifacts
ITOCHU Cyber & Intelligence Inc.

12

05 Detection and Protection
ITOCHU Cyber & Intelligence Inc.

13

How to hunt vscode execution by network activity.
●

Dev Tunnels use below hosts○Authentication■■○

Dev Tunnels
■■■■
■
■

●

github.com
login.microsoftonline.com
global.rel.tunnels.api.visualstudio.com[clusterId].rel.tunnels.api.visualstudio.com[clusterId]-data.rel.tunnels.api.visualstudio.com*.[clusterId].devtunnels.ms*.devtunnels.ms[clusterId] list is available athttps://global.rel.tunnels.api.visualstudio.com/api/v1/clusters

Detect with Context○

It would be better to detect the aforementioned communications innetworks, such as business departments or production segments, whereVSCode is not used.

ITOCHU Cyber & Intelligence Inc.

14

How to hunt vscode executing by process behavior“node.exe” execute under vscode and Image Path is“%USERPROFILE%¥.vscode¥cli¥servers¥Stable[ID]¥server¥node.exe“● PowerShell (pwsh.exe) is run under node.exe if actor create newterminal● It’s anomaly and you can detect VSCode tunnel by that path andprocess name.
●ITOCHU Cyber & Intelligence Inc.

15

Safe Use of VSCode Remote Development• VSCode is essential for modern development, and the VS Code RemoteDevelopment feature itself is very useful.
• I recommend to use Dev Containers and Visual Studio Code Remote - SSH• Dev Containers: Connect to local containers• SSH: Establish SSH connections with remote hosts. Therefore, it can becontrolled by firewall.

VS Code Remote Development - SSH

Dev Containers

ITOCHU Cyber & Intelligence Inc.

16

06 Conclusion
ITOCHU Cyber & Intelligence Inc.

17

Conclusion• VSCode was actually used as a RAT by APT.
• By using dev tunnels, attackers can remotely control throughproxies owned by Microsoft.
• In modern development, VSCode and Remote Tunnel are very
useful, but for safe use, it is recommended to use SSH or DevContainers.
• Hunt for communications to dev tunnels and processes of theVSCode Server.
• Alternatively, deny communication to dev tunnels in segments
where development communication does not occur, such as in thesales department or production network.

ITOCHU Cyber & Intelligence Inc.

18

Any Questions?

Appendix
ITOCHU Cyber & Intelligence Inc.

20

Appendix
Attackers can persist tunnel process by “code tunnel serviceinstall”● The command make auto run registory●○

HKCU¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥Run■■

Name: Visual Studio Code Tunnel
Data:●[Path to binary]¥code.exe--verbose--cli-data-dir %USERPROFILE%¥.vscode¥cli
tunnel service internal-run--log-to-file %USERPROFILE%¥.vscode¥cli¥tunnel-service.log

ITOCHU Cyber & Intelligence Inc.

21