nhattuanbl

nhattuanbl is a threat actor identifier associated with a software supply-chain campaign targeting PHP and Laravel developers through malicious Packagist packages. The actor published multiple packages under the same author name, including benign-looking packages likely intended to build credibility, while distributing at least two packages that embedded an obfuscated remote access trojan and a third package that installed the trojan transitively through a hard dependency. The operation targeted Laravel application environments by abusing Composer package installation and framework auto-loading behavior. In one package, the payload executed automatically through Laravel service-provider auto-discovery during application boot; in another, execution occurred when the package was autoloaded. The malware then spawned a detached background process, maintained persistence within the application context, performed host reconnaissance, and established encrypted command-and-control communications. Reported operator capabilities included remote command execution, file upload and download, screenshot capture, and collection of host and environment information. Because the malware ran with the same privileges as the compromised web application, it could access application secrets and environment variables, including credentials and API keys commonly stored in Laravel deployments. The payload was described as cross-platform, functioning on Windows, macOS, and Linux. It used substantial obfuscation, including control-flow flattening, escaped strings, and randomized identifiers, along with encrypted C2 messaging. The malware continuously retried outbound connections, enabling ongoing post-compromise access if infrastructure became reachable again. Observed behavior is consistent with software dependency compromise, reconnaissance, persistence, defense evasion, exfiltration, and post-exploitation activity. No high-confidence attribution to a nation state or a broader named intrusion set is currently available. The available evidence supports tracking nhattuanbl as an actor name tied to a malicious open-source package distribution campaign against the PHP/Laravel ecosystem.