NEBULA Campaign Uses Fake npm AI SDKs to Deliver a DLL-Free Windows RAT
Summary
CloudSEK links seven fake NebulaAI npm packages to a Windows RAT delivered through obfuscated install hooks. Two packages remained downloadable; the report details the payload, capabilities, and recommended defenses.
Key points
- The campaign used seven fake AI SDK packages across four sequential burner accounts; api-nebula and llm-nebula were still downloadable when reported.
- An obfuscated preinstall.cjs hook drops the payload, either from an embedded encoded file or through an install-time network request.
- The customized KNTRAT payload is written to %LOCALAPPDATA%\Microsoft\Conhost\conhost.exe and communicates with 65.87.7.132.
- The RAT uses direct NT and win32k syscalls, leaving an empty Import Address Table, and supports hidden-desktop control, camera and microphone monitoring, and Winlogon Shell persistence.
- The report recommends blocking the two packages and associated infrastructure, and detecting the drop location, custom user-agent, named pipes, and hidden-desktop artifacts.
- The implant suppressed beaconing during a 12-minute sandbox run, which the report says is consistent with anti-analysis provisions.
Article Details
- Attack Vectors
- Seven fake NebulaAI SDK packages on npm used obfuscated preinstall hooks to deploy a Windows RAT.
- The preinstall hook wrote the payload to %LOCALAPPDATA%\Microsoft\Conhost\conhost.exe, using either an embedded base64- and zlib-encoded payload or an install-time network request.
- Defensive Notes
- Restrict installation of api-nebula and llm-nebula.
- Block network communication to 65.87.7.132.
- Detect the conhost drop location, the user-agent kntrat/0xB15B00B6, named-pipe constructions, and hidden-desktop artifacts.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 65[.]87[.]7[.]132 | C2 address used by the deployed KNTRAT variant. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe preinstall hook is obfuscated, and the embedded payload is base64- and zlib-encoded.T1059.007 · JavaScriptThe malicious npm packages execute obfuscated JavaScript through a preinstall hook.T1105 · Ingress Tool TransferThe install hook can retrieve the payload through an install-time network request.T1106 · Native APIThe RAT operates through direct NT and win32k system calls.T1123 · Audio CaptureThe RAT uses Kernel Streaming for microphone monitoring.T1125 · Video CaptureThe RAT uses Kernel Streaming for camera monitoring.