Malicious NuGet Packages — JIT Hooking ASP.NET Identity Exfiltration and Persistent Backdoor via Local Proxy C2 — Threadlinqs Intelligence
As of 2026-05-30, Malicious NuGet Packages — JIT Hooking ASP.NET Identity Exfiltration and Persistent Backdoor via Local Proxy C2 is a high-severity supply chain threat attributed to hamzazaheer (N/A), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 17 indicators of compromise.
Threat ID: TL-2026-0137 · Severity: HIGH · Status: RESOLVED · Category: SUPPLY_CHAIN
Attribution: hamzazaheer · N/A · FINANCIAL
Socket Security discovered 4 malicious NuGet packages (NCryptYo, DOMOAuth2_, IRAOAuth2.0, SimpleWriter_) published by threat actor 'hamzazaheer' targeting ASP.NET developers. NCryptYo is a heavily
Socket Security's Threat Research Team discovered a sophisticated NuGet supply chain attack involving four coordinated malicious packages targeting ASP.NET web application developers. The campaign deploys a multi-stage payload architecture where each package serves a distinct role in the kill chain.
NCryptYo is the stage-1 dropper that masquerades as the legitimate NCrypto cryptography library through a three-layer naming attack: the package name typosquats NCrypto, the DLL filename NCrypt.dll mimics Windows' CNG cryptography provider (C:\Windows\System32\NCrypt.dll), and the namespace NCrypt matches Microsoft's cryptography APIs. All public methods return null unconditionally — the real functionality is encrypted and only decrypted at runtime through JIT compiler manipulation.
The dropper uses a sophisticated execution-on-load technique: its static constructor fires immediately when the assembly loads (requiring only a 'using NCrypt;' statement). It installs JIT compiler hooks by hijacking the .NET runtime's compileMethod vtable entry using native OS functions (VirtualAlloc on Windows, mmap on Unix). Platform-specific shellcode is written: 39 bytes for x64, 29 bytes for x86, 32 bytes for ARM64 (targeting Apple Silicon). Every method carries [MethodImpl(MethodImplOptions.NoInlining)] to force all calls through the modified JIT where encrypted method bodies are decrypted and compiled.
The DLL is protected with Eziriz .NET Reactor obfuscator (unregistered version with 14-day time bomb), [SuppressIldasm] attributes, RSA signature verification for tamper detection, and a custom VM engine implementing IL virtualization — a second obfuscation layer where critical methods are converted to proprietary bytecode. Five encrypted resources are embedded, with the largest being a 126 KB DOS executable (stage-2 payload) encrypted with AES-256-CBC. A second AES key, obfuscated across 200 lines of arithmetic, decrypts an RSA key. Thirteen SHA256 hashes are stored in the .text section for VM engine operation.
Anti-analysis defenses include Debugger.IsAttached checks, RSA signature verification against SHA1 hash of PE sections, and the time bomb. The DLL exports an entry point at ordinal #1, enabling standalone execution via rundll32.exe NCrypt.dll,#1 — providing distribution beyond NuGet. VirusTotal shows only 1/72 detection rate.
The stage-2 payload (126 KB) establishes a localhost proxy on port 7152 that relays traffic to the attacker's external C2 server. The C2 address is dynamically retrieved at runtime, never appearing in static artifacts. NCryptYo itself contains zero networking code — all System.Net.* types are absent from metadata.
DOMOAuth2_ integrates into ASP.NET applications via dependency injection (AddOAuth extension method) and exfiltrates ASP.NET Identity data through four API endpoints: get-permissions (AspUserId, AspRoleId), get-role-permissions (RoleId, RoleName), update-role-permissions (RoleId, ModuleIds), update-user-permissions (UserId, AspNetUserId, UserRoles). Every request includes a hardcoded auth token. The C2 response through the Message.Data field (typed dynamic) enables injection of modified authorization rules — creating a persistent backdoor where the attacker can grant admin roles, modify access controls, or disable security checks.
IRAOAuth2.0 implements the same four endpoints but removes all configurability — the hardcoded auth token is inlined and caller-supplied keys are completely ignored. This creates a redundant exfiltration channel that operates even if DOMOAuth2_ is discovered and disabled.
SimpleWriter_ presents as a PDF conversion utility but unconditionally writes attacker-controlled content to disk and executes local binaries with CreateNoWindow=true. Every ConvertHtmlToPDF() call beacons to the C2, writes files, and spawns hidden processes. The wkhtmltopdf.exe binary isn't shipped — it's placed by the NCryptYo stage-1 dropper.
All three companion packages share a byte-identical authenti
Weaknesses (CWE)
CWE-494, CWE-829, CWE-506
Target sectors: technology, developer, enterprise, financial, government
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 17 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, HIGH, threat intelligence, cybersecurity, T1195.002, T1199, T1204.002, T1059.001, T1106, T1574.002, T1546.015, T1574.002, T1027, T1027.009