cyber.hendryadrian.com
Threat Research · thehackernews.com

Nearly 800 Malicious npm Packages Deliver Cross-Platform Malware via WEL1DROPPER

· Original article ↗

Summary

Researchers describe nearly 800 malicious npm packages using WEL1DROPPER to deliver OS-specific payloads, with DNS TXT fallback, platform-specific evasion and persistence, and a Linux chain leading to Sliver.

Key points

  • Researchers found nearly 800 malicious npm packages in a campaign tracked as Flooding Dropper.
  • Package READMEs instruct developers to load the modules with require(); execution leads to WEL1DROPPER, which selects payloads by operating system and processor architecture.
  • The downloader retrieves payloads from Cloudflare Workers and can fall back to chunked DNS TXT delivery from wel1[.]ru.
  • The Windows payload reportedly interferes with ETW and AMSI monitoring, checks for analysis environments, and establishes persistence through a Registry Run key and scheduled task.
  • The macOS payload checks for analysis tools and uses a LaunchAgent for persistence; the Linux sample can ultimately deploy Sliver.
  • Researchers suspect a possible connection to the earlier Moika operation; domains in the macOS payload suggest, but do not confirm, targeting of Russian financial and mobile-payment organizations.
  • Separate reporting in the article describes npm and PyPI malware campaigns and Chrome extensions used for web crawling through a residential proxy SDK.

Article Details

Attack Vectors
  • Nearly 800 malicious npm packages reportedly prompt developers to load them with require(), which executes the WEL1DROPPER downloader.
  • WEL1DROPPER identifies the host operating system and processor architecture, then downloads a compatible payload from Cloudflare Workers hosts; DNS TXT records provide a fallback delivery method.
  • The Windows payload reportedly patches ETW and AMSI, checks for sandboxes and virtual environments, establishes persistence through a Registry Run key and scheduled task, and downloads an encrypted payload.
  • The macOS payload reportedly checks for debuggers and analysis artifacts, retrieves a payload, and establishes persistence through a LaunchAgent.
  • The Linux sample is described as a UPX-packed ELF binary that downloads auxiliary payloads and ultimately deploys Sliver.
  • Separately, some Chrome extensions reportedly use a remotely commanded WebSocket connection and an embedded bandwidth-sharing SDK to crawl web pages via hidden iframes and send content to a cloud backend.

Indicators of compromise

TypeIndicatorContext
DOMAINext[.]dl[.]wel1[.]ruLinux ARM64 payload domain used in the DNS TXT fallback delivery process.
DOMAINnet[.]dl[.]wel1[.]ruWindows payload domain used in the DNS TXT fallback delivery process.
DOMAINoob-worker[.]cf102-baf[.]workers[.]devCloudflare Workers host listed as infrastructure for WEL1DROPPER payload delivery.
DOMAINoob-worker[.]cf103-070[.]workers[.]devCloudflare Workers host used by WEL1DROPPER to deliver platform-specific payloads.
DOMAINoob-worker[.]cf99-9b3[.]workers[.]devCloudflare Workers host used by the Linux sample to download auxiliary payloads.
DOMAINpkg[.]dl[.]wel1[.]rumacOS payload domain used in the DNS TXT fallback delivery process.
DOMAINsdk[.]dl[.]wel1[.]ruLinux x64 payload domain used in the DNS TXT fallback delivery process.
DOMAINwel1[.]ruDomain queried for DNS TXT records to retrieve the next-stage payload when HTTPS downloads fail.

MITRE ATT&CK

T1027.002 · Software PackingThe Linux sample is described as a UPX-packed ELF binary.T1053.005 · Scheduled TaskThe Windows payload reportedly establishes persistence through a scheduled task.T1059.003 · Windows Command ShellThe final payload is executed using cmd.exe on Windows.T1059.004 · Unix ShellThe final payload is executed using /bin/sh on Linux and macOS.T1059.007 · JavaScriptThe malicious npm package contains downloader logic that executes when developers load it with require().T1071.004 · DNSThe downloader requests DNS TXT records containing numbered payload chunks for fallback delivery.T1105 · Ingress Tool TransferWEL1DROPPER downloads platform-specific payloads from Cloudflare Workers hosts and can retrieve them through DNS TXT records.T1195.001 · Compromise Software Dependencies and Development ToolsThe campaign distributes malicious packages through the npm registry to deliver malware when developers load them.T1497.001 · System ChecksThe Windows payload reportedly checks for sandboxes and virtual environments.T1543.001 · Launch AgentThe macOS infection chain reportedly establishes persistence using a LaunchAgent.T1547.001 · Registry Run Keys / Startup FolderThe Windows payload reportedly establishes persistence through a Registry Run key.T1562.001 · Disable or Modify ToolsThe Windows version reportedly patches ETW and AMSI to interfere with monitoring.

People

Paul McCartyOpenSourceMalware researcher who described the malicious npm packages and their downloader behavior.

Malware

WEL1DROPPERA cluster of nearly 800 malicious npm packages is being used to deliver cross-platform malware that targets Windows, macOS, and Linux through a downloader called WEL1DROPPER and a staged payload delivery process.

Products

Google ChromeThreat actors have also been observed using Google Chrome extensions marketed as game emulators, password managers, productivity tools, CSS inspectors, and markdown converters to turn the web browser into a web crawlingnpmA cluster of nearly 800 malicious npm packages is being used to deliver cross-platform malware that targets Windows, macOS, and Linux through a downloader called WEL1DROPPER and a staged payload delivery process.PyPIas Flooding Dropper and possibly linked to the earlier Moika operation, also overlaps with other npm and PyPI attacks that spread RATs, steal credentials, and abuse Chrome extensions for web crawling.

Tools

Sliver#WEL1DROPPER

Related Articles