NCryptYo
NCryptYo is a malicious NuGet package and heavily obfuscated stage-1 dropper used in a software supply-chain campaign targeting ASP.NET developers. It was published to NuGet in August 2024 by the account "hamzazaheer" as part of a four-package cluster consisting of NCryptYo, DOMOAuth2_, IRAOAuth2.0, and SimpleWriter_, which accumulated more than 4,500 downloads before removal. NCryptYo masquerades as a cryptography library by typosquatting the legitimate NCrypto package, using the namespace "NCrypt" and an assembly filename "NCrypt.dll" that mimics the Windows CNG provider path. It executes on assembly load via a static constructor, installs JIT compiler hooks, decrypts embedded payloads at runtime, and deploys a stage-2 component that establishes a localhost proxy on 127.0.0.1:7152. That proxy relays traffic from the companion packages to an attacker-controlled C2 server whose address is dynamically retrieved at runtime. The broader campaign is designed to exfiltrate ASP.NET Identity data, including user accounts, role assignments, and permission mappings, and to manipulate authorization rules returned by the C2 to create persistent backdoors in deployed applications. Reported backdoor effects include granting admin roles, modifying access controls, and disabling security checks. The companion packages communicate with hardcoded https://localhost:7152/api/auth/ endpoints through the NCryptYo proxy; DOMOAuth2_ and IRAOAuth2.0 exfiltrate authorization data, while SimpleWriter_ presents as a PDF utility but provides unconditional file-write capability and hidden process execution, including execution of ExternalLib\Windows\wkhtmltopdf.exe expected to be dropped by NCryptYo. Reported indicators and artifacts include localhost:7152, the ProjectId 06062730-b307-48a6-a7c3-140e6bae4587 embedded across companion packages, and shared package metadata and build artifacts suggesting common authorship. Researchers assessed the likely objective was compromise of applications built with the tainted dependencies so that malicious C2-driven authorization manipulation and data exfiltration persist in production deployments.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
"The campaign deploys a multi-stage payload where NCryptYo acts as a stage-1 dropper that establishes a local proxy on localhost:7152"
Techniques & procedures
11 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
2 techniques
Initial Access
Privilege Escalation
1 technique
Privilege Escalation
Stealth
5 techniques
Stealth
“The DLL is protected by .NET Reactor obfuscation… Five encrypted resources are embedded inside”
"NCryptYo masquerades as a cryptography library through deliberate typosquatting... the DLL filename NCrypt.dll mimics Windows' CNG cryptography provider at C:\\Windows\\System32\\NCrypt.dll, and the namespace NCrypt matches Microsoft's cryptography APIs."
"Static analysis confirms... VirtualAlloc + WriteProcessMemory + OpenProcess for process injection."
Discovery
1 technique
Discovery
Command and Control
2 techniques
Command and Control
Exfiltration
1 technique
Exfiltration
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Stage-1 execution-on-load dropper delivered as a malicious NuGet package. On assembly load it installs JIT compiler hooks to decrypt embedded payloads and deploy a stage-2 localhost proxy (port 7152) that relays traffic between companion malicious packages and an external C2 whose address is resolved dynamically at runtime.
Malicious NuGet package that typosquats the legitimate NCrypto library and executes on assembly load via a static constructor. It uses heavy .NET obfuscation (unregistered .NET Reactor, time-bomb, anti-debug/anti-tamper) and JIT compiler hooking to decrypt embedded payloads at runtime, then deploys a stage-2 component that establishes a localhost:7152 proxy/tunnel to attacker-controlled C2. Can also be executed standalone via rundll32 using an exported ordinal #1 entry point.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.