TXTBOOK: Dependency Confusion Campaign Drops Sliver via DNS TXT-Record Staging Against T-Bank
TXTBOOK: Dependency Confusion Campaign Drops Sliver via DNS (TL-2026-1977), also tracked as TXTBOOK, is a high-severity supply-chain compromise scored CVSS 8.7, first published 2026-08-10. It is attributed to Flooding Dropper (Russia) with low confidence, affects Tinkoff Bank (T-Bank Group) Private npm/PyPI package namespace, maps to 19 MITRE ATT&CK techniques (T1021, T1027, T1053), and is covered by 9 detection rules and 27 indicators of compromise.
Key facts for TL-2026-1977
- Threat ID
- TL-2026-1977
- Also known as
- TXTBOOK, Flooding Dropper, WEL1DROPPER
- Severity
- HIGH
- CVSS
- 8.7
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- 2026-08-10
- Last reviewed
- 2026-08-10
- Attribution
- Flooding Dropper
- Attribution confidence
- LOW
- Nation-state nexus
- Russia
- Motivation
- FINANCIAL
- Target sectors
- financial services, banking, fintech, software development
- Target regions
- russia
- Detection rules
- 9
- Indicators of compromise
- 27
Malware and tooling in TXTBOOK: Dependency Confusion Campaign Drops Sliver via DNS
Malware and tooling: WEL1DROPPER, 262CA2380CC0AB31, 68BAEB7614479037, Sliver - S0633
An unattributed operator published nearly 1,000 malicious npm/PyPI packages impersonating Tinkoff Bank's (T-Bank) private package namespace, using an import-time JavaScript trigger, an environment-aware loader that checks for the bank's internal Nexus repository before beaconing, and DNS TXT-record staging to reassemble a native second-stage that deploys a Sliver C2 implant. Independently corroborated by Sonatype ("Flooding Dropper", 846 packages) and OpenSourceMalware ("WEL1DROPPER", 700+ packages), the operator resumed publishing within ~25 hours of an npm takedown and had staging infrastructure serving valid executables as of 2026-08-03; no confirmed compromise is evidenced.
How TXTBOOK: Dependency Confusion Campaign Drops Sliver via DNS works
TXTBOOK is a dependency-confusion supply-chain campaign first tracked on PyPI in July 2026 and expanded to npm the same month, ultimately publishing 993 malicious npm package names (1,156 versions across 80+ namespace families, per CloudSEK's corpus sweep) that impersonate the private npm/PyPI namespace of Tinkoff Bank (T-Bank) and its CloudPayments processor. Independent researchers tracked overlapping or the same activity under different names: Sonatype documented 846 packages as "Flooding Dropper" (advisory sonatype-2026-005660, CVSS 8.7, CWE-506), and OpenSourceMalware researcher Paul McCarty documented 700+ packages as "WEL1DROPPER", linking it to an April/May 2026 precursor campaign called "Moika" (250+ packages) on shared tradecraft (oob-prefixed infrastructure naming, fake telemetry camouflage, comparable kill-switch mechanisms).
The package names impersonate internal T-Bank service paths across namespace families including bnpl-* (156, BNPL product), dolyame-* (133, consumer BNPL brand), devplatform-* (108), bigops-* (97), boxy-* (70), checkout-* (61), claims-* (41), tinkoff-* (38), statist-browser-typed-client-* (54, analytics clients), and bpm-foundation-* (25), plus a secondary cluster of four online-betting names. Rather than relying on npm lifecycle scripts (preinstall/postinstall), the newest generation of packages executes at import time — a README instructs the victim to run `require("checkout-mobile-bnpl")` or similar, and that call alone starts the infection chain, evading tooling that only inspects install-time hooks.
The first-stage JavaScript loader fingerprints host OS/architecture, attempts an HTTPS download from hardcoded Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev), and falls back to DNS TXT-record staging under wel1.ru if all three fail: it queries c.wel1.ru for a chunk count (1-2,000), then requests numbered TXT records (0.<domain>, 1.<domain>, ...) that reassemble into a Base64-encoded native binary. Per CloudSEK, the loader stores its hostname table obfuscated with a single-byte XOR key that differs per build, with fragments reassembled at runtime to defeat static keyword matching. Before contacting attacker infrastructure, the loader resolves T-Bank's internal Nexus artifact repository (nexus.tcsbank.ru), an internal Linux package repository, and CloudPayments' alerting endpoint (cloudpayments.ru) — proceeding to beacon only if these victim-side hosts answer, confirming execution inside the target's network before revealing itself.
Second-stage payloads are platform-specific: Windows binaries patch ETW and AMSI, check for debuggers/VMs/sandboxes/security products, establish persistence via a Registry Run key and a scheduled task, and reflectively load an encrypted payload fetched from a `/pkg/update_win.exe`-style path; a Linux x86-64 payload (UPX 3.96-packed, statically linked, SHA-256 7e486657f30594afda379b97030252a09a19fe8055e25c9e371544f59bd8e9e3) delivers a Sliver implant; and a macOS Universal payload (SHA-256 c214746c74cae8ece8bdaf69aa05da4db6ce013f9e77452d1eed1a002fd9ba00) performs additional anti-analysis checks and installs a fake LaunchAgent at ~/Library/LaunchAgents/com.apple.windowserver.helper.plist. CloudSEK additionally documents defeat of analysis-environment countermeasures (spoofed Dell OptiPlex SMBIOS strings, disabled hypervisor CPU flags, populated consumer-SSD registry disk-enum keys, full hardware virtualization, a pre-trusted lab CA).
The recovered Sliver implant is a statically linked, obfuscated Go binary encrypted with age (X25519 + ChaCha20-Poly1305) rather than Sliver's native scheme, with every server response authenticated via an Ed25519 minisign signature and traffic randomly wrapped in one of five encoders (Base64, Gzip, Hex, English-word-based, PNG steganographic). CloudSEK attributes two distinct operator servers by minisign key ID — Server A (262CA2380CC0AB31, Windows x64 + Linux ARM64 builds) and Server B (68BAEB7614479037, Linux x64 builds) — both fronted by the same Cloudflare Workers estate. CloudSEK recovered 79 of 82 Sliver command types from reflection metadata, including in-process .NET assembly execution, DLL sideloading/spawning, native and WebAssembly extension loading, five token/privilege-escalation primitives, a full SSH client with Kerberos support for constrained-delegation abuse, SOCKS proxying, port forwarding, and WireGuard tunneling.
153 disposable publisher accounts were recovered, all matching a 12-character alphanumeric username pattern (^[a-z0-9]{12}$) registered to web-library.net (mailbox equals username), collectively covering 178 of the 993 recovered package names — the remainder having already been reassigned to npm's security-holder account after takedown. The operator demonstrated resilience: npm removed nine of the first ten detected package names on 2026-08-01, and publishing resumed within ~25 hours (2026-08-02) using freshly disposable accounts; staging infrastructure was observed serving a valid native executable as of 2026-08-03. No source reports a confirmed compromise of T-Bank/Tinkoff systems. Attribution is unconfirmed: OpenSourceMalware assesses a Russian actor with moderate confidence based on the .ru C2 domain (wel1.ru) and embedded references to Russian financial institutions (tcsbank.ru, cloudpayments.ru) used as decoy/health-check traffic — an unusual choice if the actor is domestically Russian, which the sources do not resolve.
MITRE ATT&CK techniques used in TL-2026-1977
Lateral Movement
Defense Evasion
T1027 Obfuscated Files or Information; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion; T1574 Hijack Execution Flow; T1620 Reflective Code Loading
Persistence
T1053 Scheduled Task/Job; T1543 Create or Modify System Process; T1547 Boot or Logon Autostart Execution
Execution
T1059 Command and Scripting Interpreter
Command and Control
T1071 Application Layer Protocol; T1573 Encrypted Channel
Discovery
T1082 System Information Discovery
Initial Access
Credential Access
T1558 Steal or Forge Kerberos Tickets
Resource Development
T1583 Acquire Infrastructure; T1585 Establish Accounts; T1608 Stage Capabilities
defense-impairment
Affected products and versions in TXTBOOK: Dependency Confusion Campaign Drops Sliver via DNS
- Tinkoff Bank (T-Bank Group) — Private npm/PyPI package namespace impersonated by attacker-published packages (developer supply chain, not a software version)
Vulnerable versions: N/A — dependency confusion targets internal-only package names, not a product version
Fixed in: N/A - CloudPayments (T-Bank subsidiary, wholly owned since January 2023) — Alerting endpoint referenced by the loader as an environment-verification gate
Vulnerable versions: N/A
Fixed in: N/A - npm, Inc. / PyPI — npm and PyPI public package registries
Vulnerable versions: N/A — abuse of public registry namespace, not a registry software flaw
Fixed in: N/A
Remediation for TXTBOOK: Dependency Confusion Campaign Drops Sliver via DNS
Immediate actions
- Audit npm/PyPI dependency trees for any of the 993 recovered TXTBOOK/WEL1DROPPER package names or namespace families (bnpl-*, dolyame-*, devplatform-*, bigops-*, boxy-*, checkout-*, claims-*, tinkoff-*, statist-browser-typed-client-*, bpm-foundation-*)
- Block outbound resolution/traffic to wel1.ru and its subdomains (sdk.dl., ext.dl., pkg.dl., net.dl., c.) and to oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev
- Hunt for detached Node.js/npm child processes and for the temp-file patterns /var/tmp/.cache_<8 hex>, /tmp/.analytics_state, and %TEMP%\dotnet_diag_<8 hex>.exe on developer and build hosts
- Isolate and treat as compromised any host that resolved an internal artifact-repository check followed by contact to wel1.ru or the Cloudflare Workers hosts
- Rotate developer/CI credentials and npm/PyPI publish tokens on any host that imported a suspect package
Workarounds
- Restrict internal Nexus/artifact-repository (nexus.tcsbank.ru-style) DNS resolution from general developer endpoints to reduce the loader's ability to confirm it is inside the target network
Longer-term hardening
- Enforce scoped-namespace reservation on npm and PyPI for all internal package prefixes to close the dependency-confusion window
- Require lockfile-pinned, hash-verified installs and disable arbitrary `require()`-triggered execution review in CI for newly added dependencies
- Deploy EDR/behavioral detection tuned to ETW/AMSI-patching, reflective in-memory loading, and unsigned scheduled-task/Registry Run-key creation from Node.js-spawned processes
- Monitor for the Sliver minisign server-key fingerprints (262CA2380CC0AB31, 68BAEB7614479037) and the five-encoder traffic fingerprint as durable pivots that survive infrastructure rotation
Weaknesses (CWE) in TXTBOOK: Dependency Confusion Campaign Drops Sliver via DNS
CWE-506
Timeline of TXTBOOK: Dependency Confusion Campaign Drops Sliver via DNS
- OpenSourceMalware links the operation to "Moika", an April/May 2026 precursor campaign of 250+ npm packages sharing oob-prefixed infrastructure naming, fake telemetry camouflage, and comparable kill-switch mechanisms.
- CloudSEK documents the operation first established on PyPI, with staging infrastructure set up ahead of the npm expansion.
- Third-stage (Sliver-delivering) component compiled, per signing-material timestamp recovered by CloudSEK.
- Execution trigger ported to npm; the campaign begins publishing to npm alongside its ongoing PyPI activity.
- npm removes nine of the first ten detected malicious package names.
- Operator resumes publishing within roughly 25 hours of the takedown using freshly created disposable web-library.net accounts.
- CloudSEK observes the operator's staging infrastructure serving a valid native second-stage executable.
- Sonatype publishes "Flooding Dropper" research documenting 846 malicious npm packages under advisory sonatype-2026-005660.
- OpenSourceMalware researcher Paul McCarty publishes "WEL1DROPPER" analysis documenting 700+ malicious npm packages and Sliver delivery on Linux, attributing the campaign to a Russian actor with moderate confidence.
- CloudSEK publishes "TXTBOOK", identifying Tinkoff Bank/T-Bank and CloudPayments as the impersonated namespace owner, recovering 79 of 82 Sliver command types and the full DNS TXT-record loader mechanics.
Sources cited for TXTBOOK: Dependency Confusion Campaign Drops Sliver via DNS
- TXTBOOK: A Supply Chain Heist Rehearsed in Public
- Flooding Dropper Hits npm With 850 Malicious Packages
- Russian AI Slopsquatting Publishes 700+ Malicious NPM Packages
- Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer
- Flooding Dropper Hits npm With 850 Malicious Packages
- Russian Hackers Use AI Slopsquatting to Publish 700+ Malicious npm Packages
- 'Flooding Dropper' Is Hitting npm With a Tidal Wave of Malicious Packages
Threats related to TXTBOOK: Dependency Confusion Campaign Drops Sliver via DNS
Detection coverage for TL-2026-1977
As of 2026-08-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1977 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.