DEV#POOPER: Remote Access Trojan Family
DEV#POOPER is a malware family that delivers remote access trojans (RATs) via compromised npm packages, often using blockchain-based command-and-control infrastructure.
Tag: blockchain C2
Two Compromised joyfill npm Packages Deliver RAT via Blockchain-Based C2
Two npm packages in the @joyfill namespace, @joyfill/layouts@0.1.2-2773.beta.0 and @joyfill/components@4.0.0-rc24-2773-beta.4, have been compromised to deliver a remote access trojan (RAT) associated with…
Dysphoria IoT Botnet Adopts Blockchain C2 and Victim Relays After JackSkid Takedown
The Dysphoria IoT botnet, tracked by CNCERT and XLab (Qi'anxin), has evolved to use blockchain-based name services and infected-device relays following a…
Dysphoria IoT Botnet with Blockchain C2 and Victim Relays
Dysphoria is an IoT botnet tracked by CNCERT and XLab. It evolved after the JackSkid disruption to use ENS and SNS for…
Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver a RAT
Cybersecurity researchers at Checkmarx have uncovered a cluster of seven malicious npm packages targeting the Vite frontend tooling ecosystem as part of…
SuccessKey Threat Actor Behind ViteVenom and ChainVeil Campaigns
SuccessKey is the threat actor attributed to the ViteVenom and ChainVeil campaigns, which use blockchain-based C2 infrastructure to deliver remote access trojans…
ViteVenom: Malicious npm Campaign Targeting Vite Developers
ViteVenom is a malware campaign discovered by Checkmarx that uses seven malicious scoped npm packages to deliver a RAT via blockchain-based C2…
ChainVeil: Precursor Malware Campaign Using Blockchain C2
ChainVeil is a previous malware campaign that used unscoped typosquat npm packages and a four-tier blockchain C2 infrastructure to deliver a remote…
PolinRider: Threat Cluster Using Blockchain-Based C2
PolinRider is a threat cluster assessed to be related to the Contagious Interview campaign, known for using multi-blockchain resolver structures (Tron, Aptos,…