TXTBOOK: Dependency Confusion Campaign Drops Sliver via DNS TXT-Record Staging Against T-Bank

Key facts for TXTBOOK Sliver C2 npm campaign

Detection coverage for TXTBOOK Sliver C2 npm campaign

As of 2026-08-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1977 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: TXTBOOK Windows Second-Stage Persistence — Registry Run Key / Scheduled Task from dotnet_diag_* Staged Binary

Detects a Registry Run-key write or a `schtasks /create` invocation whose creating image or command line matches the %TEMP%\dotnet_diag_<8 hex>.exe staging-file pattern used by the Windows second-stage payload to establish persistence after it patches ETW/AMSI and reflectively loads its encrypted payload.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1547.001, T1053.005, T1562.001, T1620
• Data sources: sysmon, windows_security, windows_registry_telemetry
• Severity: critical
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
(
  (EventCode=13 TargetObject="*\\CurrentVersion\\Run\\*" Image="*\\dotnet_diag_*.exe")
  OR
  (EventCode=1 CommandLine="*schtasks*" (CommandLine="*dotnet_diag_*" OR CommandLine="*update_win*"))
)
| eval mitre_stage="post-exploitation persistence (Registry Run Key / Scheduled Task) from TXTBOOK second-stage staged binary"
| stats count by host, User, EventCode, Image, TargetObject, CommandLine, mitre_stage
| sort -count

Microsoft KQL

DeviceRegistryEvents
| where Timestamp > ago(24h)
| where ActionType == "RegistryValueSet"
| where RegistryKey has @"CurrentVersion\Run" and InitiatingProcessFileName has "dotnet_diag"
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, RegistryKey, RegistryValueData, EventType = "registry_run_key"
| union (
    DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where FileName =~ "schtasks.exe"
    | where ProcessCommandLine has_any ("dotnet_diag","update_win")
    | project Timestamp, DeviceName, InitiatingProcessAccountName = AccountName, InitiatingProcessFileName = FileName, RegistryKey = "", RegistryValueData = ProcessCommandLine, EventType = "scheduled_task"
)
| order by Timestamp desc

Sigma

title: TXTBOOK Second-Stage Persistence via Registry Run Key or Scheduled Task (dotnet_diag_* Staged Binary)
id: c58e2f13-6a94-4d1b-b7c2-8a3f0d5e6c19
status: experimental
description: Detects Registry Run-key creation or scheduled-task creation performed by a process matching the %TEMP%\dotnet_diag_<8 hex>.exe staging-file naming pattern used by the TXTBOOK/WEL1DROPPER Windows second-stage payload.
references:
  - https://www.cloudsek.com/blog/txtbook-a-supply-chain-heist-rehearsed-in-public
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/08/10
tags:
  - attack.persistence
  - attack.t1547.001
  - attack.t1053.005
  - attack.defense-evasion
  - attack.t1562.001
  - attack.t1620
logsource:
  category: registry_event
  product: windows
detection:
  selection_runkey:
    TargetObject|contains: 'CurrentVersion\Run'
    Image|contains: 'dotnet_diag_'
  selection_schtask:
    CommandLine|contains: 'schtasks'
    CommandLine|contains|all:
      - 'dotnet_diag_'
  condition: 1 of selection_*
falsepositives:
  - Legitimate .NET diagnostics tooling that happens to use a similarly named temp file (verify against the exact 8-hex-character suffix pattern and lack of a legitimate Microsoft signature)
level: critical

Known false positives:

• Legitimate .NET diagnostics tooling coincidentally using a similarly-formatted temp filename — verify the binary is unsigned and lacks a legitimate Microsoft certificate before escalating

Tuning notes: Pair with an unsigned-binary check (Sysmon EventCode 1 Signed=false or Authenticode verification) on the dotnet_diag_* image to cut false positives from legitimate diagnostics tooling; widen the temp-file regex to the full %TEMP%\\dotnet_diag_[0-9a-f]{8}\.exe pattern once EDR supports regex TargetObject/Image matching.

• 🔒 WEL1DROPPER First-Stage Loader Beacon to Cloudflare Workers Staging Hosts · unlock with TL Creds
• 🔒 ETW/AMSI Tamper + Reflective In-Memory Load Following Node/Python-Spawned Child Process · unlock with TL Creds
• 🔒 Sliver Minisign-Authenticated C2 Beacon over Cloudflare-Fronted [indicator] Infrastructure · unlock with TL Creds
• 🔒 Loader Environment-Confirmation Gate — T-Bank Internal Host Resolution Followed by Attacker-Domain Beacon · unlock with TL Creds
• 🔒 Cross-Platform WEL1DROPPER Second-Stage Staging & Persistence (macOS LaunchAgent / Linux Rate-Limit Marker) · unlock with TL Creds
• 🔒 Post-Sliver SSH Lateral Movement / Kerberos Ticket Abuse Following [indicator] C2 Contact · unlock with TL Creds
• 🔒 TXTBOOK Import-Time Trigger — Malicious T-Bank Namespace Package Require/Import · unlock with TL Creds
• 🔒 WEL1DROPPER DNS TXT-Record Chunked Payload Reassembly ([indicator] Fallback C2 Staging) · unlock with TL Creds

Indicators of compromise for TXTBOOK Sliver C2 npm campaign

As of 2026-08-10, Threadlinqs Intelligence tracks 27 indicators of compromise for TL-2026-1977.

Sample indicators (3 of 27)

• Domain: tcsbank[.]ru
• File hash: 7e486657f30594afda379b97030252a09a19fe8055e25c9e371544f59bd8e9e3
• Domain: cloudpayments[.]ru

Defanged, TLP:CLEAR. Full set of 27 indicators: unlock with TL Creds.

How TXTBOOK Sliver C2 npm campaign works

Independently corroborated by Sonatype ("Flooding Dropper", 846 packages) and OpenSourceMalware ("WEL1DROPPER", 700+ packages), the operator resumed publishing within ~25 hours of an npm takedown and had staging infrastructure serving valid executables as of 2026-08-03; no confirmed compromise is evidenced.

TXTBOOK is a dependency-confusion supply-chain campaign first tracked on PyPI in July 2026 and expanded to npm the same month, ultimately publishing 993 malicious npm package names (1,156 versions across 80+ namespace families, per CloudSEK's corpus sweep) that impersonate the private npm/PyPI namespace of Tinkoff Bank (T-Bank) and its CloudPayments processor. Independent researchers tracked overlapping or the same activity under different names: Sonatype documented 846 packages as "Flooding Dropper" (advisory sonatype-2026-005660, CVSS 8.7, CWE-506), and OpenSourceMalware researcher Paul McCarty documented 700+ packages as "WEL1DROPPER", linking it to an April/May 2026 precursor campaign called "Moika" (250+ packages) on shared tradecraft (oob-prefixed infrastructure naming, fake telemetry camouflage, comparable kill-switch mechanisms).

The package names impersonate internal T-Bank service paths across namespace families including bnpl-* (156, BNPL product), dolyame-* (133, consumer BNPL brand), devplatform-* (108), bigops-* (97), boxy-* (70), checkout-* (61), claims-* (41), tinkoff-* (38), statist-browser-typed-client-* (54, analytics clients), and bpm-foundation-* (25), plus a secondary cluster of four online-betting names. Rather than relying on npm lifecycle scripts (preinstall/postinstall), the newest generation of packages executes at import time — a README instructs the victim to run `require("checkout-mobile-bnpl")` or similar, and that call alone starts the infection chain, evading tooling that only inspects install-time hooks.

The first-stage JavaScript loader fingerprints host OS/architecture, attempts an HTTPS download from hardcoded Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev), and falls back to DNS TXT-record staging under wel1.ru if all three fail: it queries c.wel1.ru for a chunk count (1-2,000), then requests numbered TXT records (0.<domain>, 1.<domain>, ...) that reassemble into a Base64-encoded native binary. Per CloudSEK, the loader stores its hostname table obfuscated with a single-byte XOR key that differs per build, with fragments reassembled at runtime to defeat static keyword matching. Before contacting attacker infrastructure, the loader resolves T-Bank's internal Nexus artifact repository (nexus.tcsbank.ru), an internal Linux package repository, and CloudPayments' alerting endpoint (cloudpayments.ru) — proceeding to beacon only if these victim-side hosts answer, confirming execution inside the target's network before revealing itself.

Second-stage payloads are platform-specific: Windows binaries patch ETW and AMSI, check for debuggers/VMs/sandboxes/security products, establish persistence via a Registry Run key and a scheduled task, and reflectively load an encrypted payload fetched from a `/pkg/update_win.exe`-style path; a Linux x86-64 payload (UPX 3.96-packed, statically linked, SHA-256 7e486657f30594afda379b97030252a09a19fe8055e25c9e371544f59bd8e9e3) delivers a Sliver implant; and a macOS Universal payload (SHA-256 c214746c74cae8ece8bdaf69aa05da4db6ce013f9e77452d1eed1a002fd9ba00) performs additional anti-analysis checks and installs a fake LaunchAgent at ~/Library/LaunchAgents/com.apple.windowserver.helper.plist. CloudSEK additionally documents defeat of analysis-environment countermeasures (spoofed Dell OptiPlex SMBIOS strings, disabled hypervisor CPU flags, populated consumer-SSD registry disk-enum keys, full hardware virtualization, a pre-trusted lab CA).

The recovered Sliver implant is a statically linked, obfuscated Go binary encrypted with age (X25519 + ChaCha20-Poly1305) rather than Sliver's native scheme, with every server response authenticated via an Ed25519 minisign signature and traffic randomly wrapped in one of five encoders (Base64, Gzip, Hex, English-word-based, PNG steganographic). CloudSEK attributes two distinct operator servers by minisign key ID — Server A (262CA2380CC0AB31, Windows x64 + Linux ARM64 builds) and Server B (68BAEB7614479037, Linux x64 builds) — both fronted by the same Cloudflare Workers estate. CloudSEK recovered 79 of 82 Sliver command types from reflection metadata, including in-process .NET assembly execution, DLL sideloading/spawning, native and WebAssembly extension loading, five token/privilege-escalation primitives, a full SSH client with Kerberos support for constrained-delegation abuse, SOCKS proxying, port forwarding, and WireGuard tunneling.

153 disposable publisher accounts were recovered, all matching a 12-character alphanumeric username pattern (^[a-z0-9]{12}$) registered to web-library.net (mailbox equals username), collectively covering 178 of the 993 recovered package names — the remainder having already been reassigned to npm's security-holder account after takedown. The operator demonstrated resilience: npm removed nine of the first ten detected package names on 2026-08-01, and publishing resumed within ~25 hours (2026-08-02) using freshly disposable accounts; staging infrastructure was observed serving a valid native executable as of 2026-08-03. No source reports a confirmed compromise of T-Bank/Tinkoff systems. Attribution is unconfirmed: OpenSourceMalware assesses a Russian actor with moderate confidence based on the .ru C2 domain (wel1.ru) and embedded references to Russian financial institutions (tcsbank.ru, cloudpayments.ru) used as decoy/health-check traffic — an unusual choice if the actor is domestically Russian, which the sources do not resolve.

MITRE ATT&CK techniques by tactic:

Lateral Movement

T1021 Remote Services

Defense Evasion

T1027 Obfuscated Files or Information; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion; T1574 Hijack Execution Flow; T1620 Reflective Code Loading

Persistence

T1053 Scheduled Task/Job; T1543 Create or Modify System Process; T1547 Boot or Logon Autostart Execution

Execution

T1059 Command and Scripting Interpreter

Command and Control

T1071 Application Layer Protocol; T1573 Encrypted Channel

Discovery

T1082 System Information Discovery

Initial Access

T1195 Supply Chain Compromise

Credential Access

T1558 Steal or Forge Kerberos Tickets

Resource Development

T1583 Acquire Infrastructure; T1585 Establish Accounts; T1608 Stage Capabilities

defense-impairment

T1685 Disable or Modify Tools

Remediation for TXTBOOK Sliver C2 npm campaign

Immediate actions

• Audit npm/PyPI dependency trees for any of the 993 recovered TXTBOOK/WEL1DROPPER package names or namespace families (bnpl-*, dolyame-*, devplatform-*, bigops-*, boxy-*, checkout-*, claims-*, tinkoff-*, statist-browser-typed-client-*, bpm-foundation-*)
• Block outbound resolution/traffic to wel1.ru and its subdomains (sdk.dl., ext.dl., pkg.dl., net.dl., c.) and to oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev
• Hunt for detached Node.js/npm child processes and for the temp-file patterns /var/tmp/.cache_<8 hex>, /tmp/.analytics_state, and %TEMP%\dotnet_diag_<8 hex>.exe on developer and build hosts
• Isolate and treat as compromised any host that resolved an internal artifact-repository check followed by contact to wel1.ru or the Cloudflare Workers hosts
• Rotate developer/CI credentials and npm/PyPI publish tokens on any host that imported a suspect package

Workarounds

• Restrict internal Nexus/artifact-repository (nexus.tcsbank.ru-style) DNS resolution from general developer endpoints to reduce the loader's ability to confirm it is inside the target network

Longer-term hardening

• Enforce scoped-namespace reservation on npm and PyPI for all internal package prefixes to close the dependency-confusion window
• Require lockfile-pinned, hash-verified installs and disable arbitrary `require()`-triggered execution review in CI for newly added dependencies
• Deploy EDR/behavioral detection tuned to ETW/AMSI-patching, reflective in-memory loading, and unsigned scheduled-task/Registry Run-key creation from Node.js-spawned processes
• Monitor for the Sliver minisign server-key fingerprints (262CA2380CC0AB31, 68BAEB7614479037) and the five-encoder traffic fingerprint as durable pivots that survive infrastructure rotation

Affected and fixed versions

• Tinkoff Bank (T-Bank Group) — Private npm/PyPI package namespace impersonated by attacker-published packages (developer supply chain, not a software version)
  Vulnerable versions: N/A — dependency confusion targets internal-only package names, not a product version
  Fixed in: N/A
• CloudPayments (T-Bank subsidiary, wholly owned since January 2023) — Alerting endpoint referenced by the loader as an environment-verification gate
  Vulnerable versions: N/A
  Fixed in: N/A
• npm, Inc. / PyPI — npm and PyPI public package registries
  Vulnerable versions: N/A — abuse of public registry namespace, not a registry software flaw
  Fixed in: N/A

Timeline of TXTBOOK Sliver C2 npm campaign

• 2026-05-01 OpenSourceMalware links the operation to "Moika", an April/May 2026 precursor campaign of 250+ npm packages sharing oob-prefixed infrastructure naming, fake telemetry camouflage, and comparable kill-switch mechanisms.
• 2026-07-01 CloudSEK documents the operation first established on PyPI, with staging infrastructure set up ahead of the npm expansion.
• 2026-07-04 Third-stage (Sliver-delivering) component compiled, per signing-material timestamp recovered by CloudSEK.
• 2026-07-15 Execution trigger ported to npm; the campaign begins publishing to npm alongside its ongoing PyPI activity.
• 2026-08-01 npm removes nine of the first ten detected malicious package names.
• 2026-08-02 Operator resumes publishing within roughly 25 hours of the takedown using freshly created disposable locked-ioc-17 accounts.
• 2026-08-03 CloudSEK observes the operator's staging infrastructure serving a valid native second-stage executable.
• 2026-08-05 Sonatype publishes "Flooding Dropper" research documenting 846 malicious npm packages under advisory sonatype-2026-005660.
• 2026-08-06 OpenSourceMalware researcher Paul McCarty publishes "locked-ioc-22" analysis documenting 700+ malicious npm packages and locked-ioc-27 delivery on Linux, attributing the campaign to a Russian actor with moderate confidence.
• 2026-08-10 CloudSEK publishes "TXTBOOK", identifying Tinkoff Bank/T-Bank and CloudPayments as the impersonated namespace owner, recovering 79 of 82 locked-ioc-27 command types and the full DNS TXT-record loader mechanics.

Sources cited for TXTBOOK Sliver C2 npm campaign

• TXTBOOK: A Supply Chain Heist Rehearsed in Public cloudsek.com · Blog · 2026-08-10
• Flooding Dropper Hits npm With 850 Malicious Packages sonatype.com · Blog · 2026-08-05
• Russian AI Slopsquatting Publishes 700+ Malicious NPM Packages opensourcemalware.com · Blog · 2026-08-06
• Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer The Hacker News · News · 2026-08-07
• Flooding Dropper Hits npm With 850 Malicious Packages securityboulevard.com · News · 2026-08-07
• Russian Hackers Use AI Slopsquatting to Publish 700+ Malicious npm Packages gbhackers.com · News · 2026-08-06
• 'Flooding Dropper' Is Hitting npm With a Tidal Wave of Malicious Packages devops.com · News · 2026-08-07

Threats related to TXTBOOK Sliver C2 npm campaign

• Suspected Russian Actor Uses AI Slopsquatting to Publish 1,000+ Malicious npm Packages (WEL1DROPPER / "Flooding Dropper")
• Nearly 800 Malicious npm Packages Deliver Cross-Platform WEL1DROPPER RAT and Infostealer ('Flooding Dropper' Campaign)

Previous and next in supply chain

• Royal Navy K3 Scout Drone Cameras Found Transmitting Heartbeat Signals to China-Based IP Address Previous report
• BdThemes WordPress Plugin Supply-Chain Attack Poisons API to Create Rogue Admins Next report

Further reading

• TeamPCP Supply Chain Attack on Trivy, LiteLLM
• Axios Supply Chain Attack: Cross-Platform RATs
• npm Supply Chain Attacks 2026: 218 Packages