In a recent discovery, Socket’s Threat Research Team uncovered a sophisticated supply chain attack targeting ASP.NET developers.
This attack, involving four malicious NuGet packages, is designed to exfiltrate sensitive login credentials and create persistent backdoors within affected applications.
The campaign deploys a multi-stage payload, starting with the NCryptYo dropper, followed by the credential-harvesting packages DOMOAuth2_, IRAOAuth2.0, and SimpleWriter_. The malicious packages have been downloaded over 4,500 times since their release in August 2024.
The lead package, NCryptYo, masquerades as a cryptography library, exploiting typosquatting by mimicking the legitimate NCrypto package.
While NCrypto performs real cryptographic functions, NCryptYo’s public API returns null for every method, indicating its malicious intent.
The package’s static constructor installs Just-In-Time (JIT) compiler hooks that decrypt payloads and deploy a proxy on localhost:7152, which relays traffic to a command-and-control (C2) server controlled by the threat actor.
The DOMOAuth2_ and IRAOAuth2.0 packages focus on stealing ASP.NET Identity data, including user accounts, roles, and permissions.
These packages exfiltrate data via the proxy established by NCryptYo, and also allow the attacker to inject custom authorization rules into the affected application.
This creates a persistent backdoor, allowing the attacker to grant themselves administrative access to the application.
NCrypt.dll, highlighting the challenges of detecting heavily obfuscated .NET malware (Source: socket)Meanwhile, SimpleWriter_, disguised as a PDF conversion utility, allows the attacker to execute local binaries and write arbitrary content to disk.
Every time the method ConvertHtmlToPDF() is called, the package contacts the C2 server. It can execute files, even if the server is unreachable. The ability to write files and execute processes without network connectivity makes this package especially dangerous.
The Attack Chain and Its Evolution
According to Socket Research team, the attack begins when a developer installs NCryptYo under the guise of a cryptographic library. Once the package is loaded, its JIT hooks trigger, decrypting and executing a second-stage payload that sets up a local proxy on localhost:7152.
This proxy facilitates communication with the C2 server, which is resolved dynamically at runtime. The DOMOAuth2_ and IRAOAuth2.0 packages use this proxy to exfiltrate sensitive ASP.NET identity data, including user roles and permissions.
The data sent back to the C2 server can be modified by the attacker, allowing them to inject altered permissions and even grant themselves administrator privileges.
This enables a long-term, undetected backdoor into the victim’s application, which can remain active even after deployment to production environments.
The SimpleWriter_ package adds another layer to the attack by allowing the attacker to write files to the system and execute processes, potentially injecting further malicious components.
Recommendations For Developers and Security Teams
For Developers:
- Be cautious when installing packages from unknown authors. Always verify package names, author identities, and download counts.
- Look for suspicious behaviors, such as JIT compiler manipulation or code that executes on assembly load, which are common in supply chain attacks.
- Monitor for unusual localhost connections and investigate any dependencies that use uncommon ports, such as localhost:7152.
- Enable NuGet security features, such as package signature verification, and use lock files to prevent unauthorized updates.
For Security Teams:
- Monitor for obfuscation markers, JIT compiler manipulation, and unusual networking patterns associated with localhost proxies.
- Implement behavioral monitoring to detect persistent connections to C2 servers and unauthorized changes to application authorization data.
- Employ automated scanning tools in the CI/CD pipeline to identify malicious packages before they are included in production builds.
Ncryptyo identifying the typosquatting pattern, non-functional public API, JIT compiler hooking, and multi-stage dropper architecture before the package could execute (Source: socket)Socket’s security solutions, including the Socket CLI and Socket Firewall, provide layers of defense against this type of attack by blocking malicious packages and preventing compromised dependencies from entering production environments.
By incorporating these tools into development workflows, organizations can better defend against evolving supply chain threats.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
