Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
These were all the Remote Access Trojan (RAT) DEV#POPPER.JS variants which we found in our prior investigation.
At the heart of this operation lies a JavaScript-based Remote Access Trojan that we've identified as a variant of the DEV#POPPER malware family, which we're calling DEV#POPPER.js.
15 distinct techniques documented for this family, organized by ATT&CK tactic.
novel tradecraft such as Cross-Chain TxDataHiding techniques combined with the subsequent creation of a takedown-proof Command and control (C2) infrastructure
a multi-layered attack leveraging novel blockchain-based command-and-control infrastructure
HTTP Request to C2: URL: http://23.27.20.143:27017/$/boot... requests.post(url, data=data, files=files)... WebSocket via socket.io.
Mitre ATT&CK Tactic... Command and Control TA0011 Non-Application Layer Protocol T1095
66 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A JavaScript-based remote access trojan delivered via blockchain transaction data hiding, with multiple variants and rotating C2 IPs used in the campaign.
A cross-platform Node.js/JavaScript remote access trojan and loader that uses cross-chain blockchain transaction data hiding for payload retrieval, provides remote code execution, persistence via VSCode/Cursor IDE injection, telemetry and environment-variable exfiltration, and can fetch additional payloads including a Python stealer.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.