TXTBOOK is a targeted dependency confusion campaign that published 993 malicious npm packages under T-Bank’s private internal namespace, with earlier activity on PyPI and infrastructure tied to DNS-based payload staging and Sliver implants. CloudSEK’s analysis traced the operation through staging domains, command-and-control servers, and victim-gating hostnames that confirm the malware was designed to run inside T-Bank’s internal network. #TXTBOOK #TBank #CloudSEK #Sliver #PyPI #npm
Keypoints
- TXTBOOK is a dependency confusion operation aimed at T-Bank, not random registry flooding.
- The campaign used 993 npm packages named after T-Bank’s private package namespace, including BNPL, banking, analytics, and internal tooling names.
- The same activity was first seen on PyPI in July 2026 and then ported to npm with ecosystem-specific execution triggers.
- The loader retrieves its payload through DNS TXT records and ultimately delivers a Sliver implant with near-complete capabilities.
- Three decoded hostnames in the loader point to victim infrastructure, proving the malware checks for execution inside T-Bank’s internal network.
- The operator used staged infrastructure, multiple Cloudflare accounts, and two distinct operator servers identified by minisign and age keys.
- Public open source repositories and internal naming conventions likely helped the operator reconstruct T-Bank’s private package namespace.
MITRE Techniques
- [T1056.001 ] Input Capture: Keylogging – The implant includes input-related functionality as part of its post-exploitation capability set (‘full command set’ and complete control features were recovered).
- [T1036 ] Masquerading – Malicious packages were published under names that impersonate T-Bank’s internal private namespace (‘they reproduce the internal, private package namespace of a single organisation’).
- [T1195.002 ] Supply Chain Compromise: Compromise Software Supply Chain – The operator distributed malicious npm and PyPI packages to trigger execution in downstream build environments (‘publishing malicious packages to the public npm registry’).
- [T1059 ] Command and Scripting Interpreter – The npm package executes code on import and the PyPI package executes startup code (‘a required call to the package entry point’ / ‘the interpreter runs at startup’).
- [T1071.004 ] Application Layer Protocol: DNS – The loader stages payloads by reassembling them from DNS TXT records (‘reassembles a native executable from several hundred DNS TXT records’).
- [T1105 ] Ingress Tool Transfer – The native payload is delivered to the system in staged form before the Sliver implant runs (‘the third stage that arrives by this route’).
- [T1027 ] Obfuscated Files or Information – Hostnames, strings, and keys are stored or encoded in obfuscated form (‘the loader stores its hostname table obfuscated’; ‘string constants in the binary’).
- [T1021.004 ] Remote Services: SSH – The implant includes a complete SSH client for lateral movement (‘Complete SSH client’).
- [T1106 ] Native API – The loader reflectively maps and parses the executable header by hand (‘maps its payload reflectively, allocating memory and parsing the executable header by hand’).
- [T1562.001 ] Impair Defenses: Disable or Modify Tools – The malware is built to evade sandboxes and inspection, including anti-analysis checks (‘the sample refuses to run in commercial sandboxes’).
- [T1552 ] Unsecured Credentials – Sensitive keys and hostnames are recovered from live memory and disk (‘the operator key… are all absent from the unpacked binary’ and were recovered from memory).
- [T1021.001 ] Remote Services: Remote Desktop Protocol – Not explicitly mentioned; omitted.
Indicators of Compromise
- [Domains ] staging and C2 infrastructure – examples include dns staging zones and Cloudflare Workers-based command-and-control estate; specific victim-gate hostnames include nexus.tcsbank.ru and internal artifact repositories for T-Bank.
- [Domains ] target-gating hostnames – nexus.tcsbank.ru, CloudPayments internal repository hostname (victim infrastructure used to confirm internal-network execution).
- [Publisher mailbox domain ] disposable operator accounts – web-library.net (used by 153 publisher accounts), and the legacy account alekseil-spam@[redacted domain].
- [Minisign signing keys ] operator server identity pivots – 262CA2380CC0AB31, 68BAEB7614479037.
- [age recipient keys ] operator encryption identity – age1pzpn8l7…ssd8l2g9, age1rnmw52sl…jd38qrzjrnh.
- [Encoded/decoded hostnames ] loader configuration – nine decoded hostnames total, including attacker infrastructure and victim infrastructure entries.
- [Package names ] malicious npm package inventory – examples include bnpl-api, dolyame-boxy-independent-bnpl-tiles, tinkoff-statist-browser-typed-client-sme.rko.conversionpayments.web, and tramvai-tinkoff-module-legacy-popup.
- [File names ] loader and implant artifacts – setup.js, _adapter.js, _bridge.js, _init.js, _compat.js, and _runtime.js.
- [Network protocol artifacts ] TXT lookup staging and beaconing – sequential DNS TXT queries that reconstruct an executable; random-letter-spliced numeric query parameter used to select one of five transport encoders.
- [Encoder fingerprints ] beacon transport modes – Base64, Gzip, Hex, English, and PNG encoders with build-specific IDs 909, 17894, 51439, 52716, and 61017.
Read more: https://www.cloudsek.com/blog/txtbook-a-supply-chain-heist-rehearsed-in-public