Single operator published five coordinated npm packages in a 12-minute burst on 2026-06-16 (14:44:00-14:56:56 UTC) to deliver a Windows binary dropper split across packages. Two fabricated GitHub orgs (akuznetsov-oss, vpetrov-oss, now 404), throwaway maintainer emails under custom domain deltajohnsons.com (one random local-part per package), and two invented author personas (Anton Kuznetsov <[email protected]>, Viktor Petrov <[email protected]>). Weaponized: procwire (dropper) + routecraft (Express typosquat on-Windows trigger). Tooling: bytecraft (XOR helper), endpointmap (metadata-only C2 store), staticlayer (the operator's own payload server side, UA-gated). Assessed NET-NEW operator/cluster (high confidence); not a known actor. The only shared atom with prior KB campaigns is catbox.moe (broadly-abused shared infra, used here for inbound payload staging vs LofyGang outbound exfil) — coincidental, NOT attribution.
Objective
Deliver and execute a hidden Windows binary payload on developer/CI machines via npm install, splitting the dropper across multiple packages to evade per-package detection.
Packages
Indicators
- domain deltajohnsons.comindicates
- github_repo akuznetsov-ossindicates
- github_repo vpetrov-ossindicates
- email [email protected]indicates
- email [email protected]indicates
- url https://files.catbox.moe/j4loim.chkcommunicates-with
- domain files.catbox.moecommunicates-with
- file_path lib/setup.jsindicates
- email [email protected]indicates
- email [email protected]indicates
- file_path lib/registry.jsindicates
- email [email protected]indicates
- email [email protected]indicates
- email [email protected]indicates
Techniques
- ttp T1195.002 Compromise Software Supply Chainuses
- ttp T1059.007 Command and Scripting Interpreter: JavaScriptuses
- ttp T1140 Deobfuscate/Decode Files or Informationuses
- ttp T1027 Obfuscated Files or Informationuses
- ttp T1105 Ingress Tool Transferuses
- ttp T1197 BITS Jobsuses
- ttp T1059.001 Command and Scripting Interpreter: PowerShelluses
- ttp T1059.003 Command and Scripting Interpreter: Windows Command Shelluses
- ttp T1553.005 Subvert Trust Controls: Mark-of-the-Web Bypassuses
- ttp T1036.005 Masquerading: Match Legitimate Name or Locationuses
- ttp T1564.003 Hide Artifacts: Hidden Windowuses
- ttp T1071.001 Application Layer Protocol: Web Protocolsuses
- ttp T1102 Web Serviceuses
