Botnetconnectionwarning polyfill.io - some brainstorming please ;-)

[menatwork]

Hi folks,

I wonder if I interpret the following right. The "Domain" polyfill.io is listed at Fortiguardservices as "bad" since 26th of June 2024.  

See: Threat Signal Report | FortiGuard Labs

We recognized in our FGT, that we have logs about botnet-cc-connections exactly to this domain (polyfill.io). Our investigations show that our DC is trying to lookup the domain. When it tries it, the FGT redirects the request, which is good.

My assumption now is, that our clients (or some of them) are trying to lookup polyfill.io, ask our Domaincontroller/DNS and the DC/DNS is forwarding the request to the provider-dns. Then the FGT blocks it.

As polyfill.io was not "bad" before 26th of june and a lot of websites use the services of polyfill.io i further assume, that our clients are simply surfing to websites, which use this "tool" (polyfill) and then we got the botnetwarning.

We have not found any indication of a infection at our internal computers till now.

So, what do you think? Is my assumption something you say: Yes this is a way it might be, or do you think that this has to be an infection of our internal client(s)?

Thanks!

[pminarik]

Given how fresh the advisory about polyfill.io being taken over by a malicious actor is, this is more likely to be innocent clients accessing regular websites that are using the polyfill JS library. Still, it won't hurt paying closer attention to your clients just to be safe.

Btw, according to the original source's updates ( https://sansec.io/research/polyfill-supply-chain-attack ), it looks like the cdn.polyfill.io domain has been withdrawn completely from DNS (doesn't resolve to anything anymore), so risks from this specific hostname should be mitigated for now. But look out for the others (mentioned in the same link).