{ "campaign": { "name": "procwire / deltajohnsons Windows Dropper", "slug": "procwire-deltajohnsons-windows-dropper", "href": "/ti/campaigns/procwire-deltajohnsons-windows-dropper", "description": "Single operator published five coordinated npm packages in a 12-minute burst on 2026-06-16 (14:44:00-14:56:56 UTC) to deliver a Windows binary dropper split across packages. Two fabricated GitHub orgs (akuznetsov-oss, vpetrov-oss, now 404), throwaway maintainer emails under custom domain deltajohnsons.com (one random local-part per package), and two invented author personas (Anton Kuznetsov , Viktor Petrov ). Weaponized: procwire (dropper) + routecraft (Express typosquat on-Windows trigger). Tooling: bytecraft (XOR helper), endpointmap (metadata-only C2 store), staticlayer (the operator's own payload server side, UA-gated). Assessed NET-NEW operator/cluster (high confidence); not a known actor. The only shared atom with prior KB campaigns is catbox.moe (broadly-abused shared infra, used here for inbound payload staging vs LofyGang outbound exfil) — coincidental, NOT attribution.", "objective": "Deliver and execute a hidden Windows binary payload on developer/CI machines via npm install, splitting the dropper across multiple packages to evade per-package detection.", "aliases": [], "discovered_at": "2026-06-17" }, "packages": [ { "ecosystem": "npm", "name": "procwire", "href": "/ti/packages/npm/procwire", "threat_types": [ "c2_agent", "persistence", "other" ], "versions": [ "1.3.0" ] }, { "ecosystem": "npm", "name": "routecraft", "href": "/ti/packages/npm/routecraft", "threat_types": [ "typosquat", "other" ], "versions": [ "4.2.0" ] }, { "ecosystem": "npm", "name": "endpointmap", "href": "/ti/packages/npm/endpointmap", "threat_types": [ "c2_agent", "other" ], "versions": [ "2.1.0" ] }, { "ecosystem": "npm", "name": "bytecraft", "href": "/ti/packages/npm/bytecraft", "threat_types": [ "other" ], "versions": [ "1.5.0" ] }, { "ecosystem": "npm", "name": "staticlayer", "href": "/ti/packages/npm/staticlayer", "threat_types": [ "c2_agent", "other" ], "versions": [ "1.1.0" ] } ], "indicators": [ { "kind": "domain", "value": "deltajohnsons.com", "href": "/ti/ioc/domain/deltajohnsons.com", "context": "Custom throwaway email domain shared across all five npm maintainer accounts (one unique random local-part per package). Strongest cluster fingerprint for this operator." }, { "kind": "github_repo", "value": "akuznetsov-oss", "href": "/ti/ioc/github_repo/github_repo-c2638f053756", "context": "Fabricated GitHub organization (now 404) for procwire and routecraft." }, { "kind": "github_repo", "value": "vpetrov-oss", "href": "/ti/ioc/github_repo/github_repo-f219a1772e7c", "context": "Fabricated GitHub organization (now 404) for bytecraft, endpointmap, staticlayer." }, { "kind": "email", "value": "akuznetsov-dev@protonmail.com", "href": "/ti/ioc/email/akuznetsov-dev@protonmail.com", "context": "Invented author persona 'Anton Kuznetsov' (akuznetsov-oss org packages: procwire, routecraft)." }, { "kind": "email", "value": "vpetrov-node@protonmail.com", "href": "/ti/ioc/email/vpetrov-node@protonmail.com", "context": "Invented author persona 'Viktor Petrov' (vpetrov-oss org packages: bytecraft, endpointmap, staticlayer)." }, { "kind": "url", "value": "https://files.catbox.moe/j4loim.chk", "href": "/ti/ioc/url/url-5c84395b1a04", "context": "Decoded C2 / payload URL, reconstructed from endpointmap's _ep+_p byte arrays XOR-decoded with the name-derived key 'endpoint'. catbox.moe is a public anonymous file host abused for inbound payload staging." }, { "kind": "domain", "value": "files.catbox.moe", "href": "/ti/ioc/domain/files.catbox.moe", "context": "Payload staging host. catbox.moe flagged by 6/92 VirusTotal vendors at analysis time. Shared atom with LofyGang (lofygang-undicy-http) but used here for INBOUND payload staging vs LofyGang's OUTBOUND exfil — coincidental shared infra, NOT attribution." }, { "kind": "file_path", "value": "lib/setup.js", "href": "/ti/ioc/file_path/file_path-eebe441416ca", "context": "procwire preinstall entrypoint: win32 guard, name-derived XOR key, C2 decode, worker.init()." }, { "kind": "email", "value": "avu2mglrijzlnu4ujkca@deltajohnsons.com", "href": "/ti/ioc/email/avu2mglrijzlnu4ujkca@deltajohnsons.com", "context": "procwire maintainer email." }, { "kind": "email", "value": "sg5kcaiezwyf9umsphqc@deltajohnsons.com", "href": "/ti/ioc/email/sg5kcaiezwyf9umsphqc@deltajohnsons.com", "context": "routecraft maintainer email." }, { "kind": "file_path", "value": "lib/registry.js", "href": "/ti/ioc/file_path/file_path-c76cf141522a", "context": "endpointmap metadata-only C2 store: XOR-encoded _ep and _p byte arrays disguised as endpoint constants." }, { "kind": "email", "value": "hmlfyhj29biz62gkvxbh@deltajohnsons.com", "href": "/ti/ioc/email/hmlfyhj29biz62gkvxbh@deltajohnsons.com", "context": "endpointmap maintainer email." }, { "kind": "email", "value": "dstc2xvtq7fszbvmbvic@deltajohnsons.com", "href": "/ti/ioc/email/dstc2xvtq7fszbvmbvic@deltajohnsons.com", "context": "bytecraft maintainer email." }, { "kind": "email", "value": "ynn47wq89mvauxti9zgf@deltajohnsons.com", "href": "/ti/ioc/email/ynn47wq89mvauxti9zgf@deltajohnsons.com", "context": "staticlayer maintainer email." } ], "ttps": [ { "name": "Compromise Software Supply Chain", "mitre_attack_id": "T1195.002", "href": "/ti/ttps/T1195.002" }, { "name": "Command and Scripting Interpreter: JavaScript", "mitre_attack_id": "T1059.007", "href": "/ti/ttps/T1059.007" }, { "name": "Deobfuscate/Decode Files or Information", "mitre_attack_id": "T1140", "href": "/ti/ttps/T1140" }, { "name": "Obfuscated Files or Information", "mitre_attack_id": "T1027", "href": "/ti/ttps/T1027" }, { "name": "Ingress Tool Transfer", "mitre_attack_id": "T1105", "href": "/ti/ttps/T1105" }, { "name": "BITS Jobs", "mitre_attack_id": "T1197", "href": "/ti/ttps/T1197" }, { "name": "Command and Scripting Interpreter: PowerShell", "mitre_attack_id": "T1059.001", "href": "/ti/ttps/T1059.001" }, { "name": "Command and Scripting Interpreter: Windows Command Shell", "mitre_attack_id": "T1059.003", "href": "/ti/ttps/T1059.003" }, { "name": "Subvert Trust Controls: Mark-of-the-Web Bypass", "mitre_attack_id": "T1553.005", "href": "/ti/ttps/T1553.005" }, { "name": "Masquerading: Match Legitimate Name or Location", "mitre_attack_id": "T1036.005", "href": "/ti/ttps/T1036.005" }, { "name": "Hide Artifacts: Hidden Window", "mitre_attack_id": "T1564.003", "href": "/ti/ttps/T1564.003" }, { "name": "Application Layer Protocol: Web Protocols", "mitre_attack_id": "T1071.001", "href": "/ti/ttps/T1071.001" }, { "name": "Web Service", "mitre_attack_id": "T1102", "href": "/ti/ttps/T1102" } ], "related_campaigns": [], "reports": [ { "title": "Five npm Packages That Hide a Windows Binary Dropper", "url": "https://safedep.io/procwire-npm-windows-dropper-campaign", "published_at": "2026-06-17" } ] }