Full Report
Cybersecurity researchers have discovered a NuGet typosquat that's unlike the typical information-stealing malware distributed via package registries: usual info-stealers: it's designed to rig live game results on Digitain. The package, named "Newtonsoftt.Json.Net," masquerades as the Newtonsoft.Json library and is a trojanized fork. Seven versions of the package have been published to the
Analysis Summary
# Tool/Technique: Newtonsoftt.Json.Net (Trojanized Typosquat)
## Overview
This is a highly targeted supply chain attack involving a trojanized fork of the popular `Newtonsoft.Json` library. Primarily distributed via the NuGet package registry, its purpose is not general data theft but the specific manipulation of live game results on the Digitain online betting platform (specifically the "FG-Crash" game). It functions as a legitimate library for most users, only activating its malicious logic when specific backend methods of the target platform are detected.
## Technical Details
- **Type:** Malware | Supply Chain Attack (Typosquat)
- **Platform:** .NET environments (Servers running Digitain game backends)
- **Capabilities:** Game outcome rigging, data exfiltration, detection evasion (delay/obfuscation).
- **First Seen:** August 13, 2025 (Initial versions published).
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1195.002 - Supply Chain Compromise: Compromise Software Dependencies]
- **[TA0005 - Defense Evasion]**
- [T1027 - Obfuscated Files or Information] (Use of ConfuserEx and Reflection)
- [T1497.003 - Virtualization/Sandbox Evasion: Time Based Evasion] (Randomized delays)
- **[TA0010 - Exfiltration]**
- [T1041 - Exfiltration Over C2 Channel]
## Functionality
### Core Capabilities
- **Method Patching:** Once `JsonConvert.DefaultSettings` is initialized, the malware attempts to patch specific methods within the Digitain "FG-Crash" backend to manipulate game outcomes.
- **Precision Targeting:** The code remains dormant unless it detects the specific environment of the target organization, allowing it to pass as a functional library for other developers.
- **Data Exfiltration:** Sends rigged round results to an external server while masquerading the traffic as harmless telemetry data.
### Advanced Features
- **Stealth and Obfuscation:** Earlier generations utilized **ConfuserEx** and **Reflection** to hide malicious calls.
- **Detection Evasion:** Implements a randomized delay via the `DefaultSettings` property setter to bypass automated analysis environments (sandboxes).
- **Custom Headers:** Uses a specific API key header (`X-Seq-ApiKey: theperfectheist2025`) for exfiltration.
## Indicators of Compromise
- **File Names:** `Newtonsoftt.Json.Net` (Notice the double 't')
- **Versions:** 11.0.4, 11.0.5, 11.0.7, 11.0.8, 11.0.9, 11.0.10, and 11.0.11.
- **Network Indicators:**
- `185.126.237[.]64:5341` (C2/Exfiltration endpoint)
- HTTP Header: `X-Seq-ApiKey: theperfectheist2025`
- **Behavioral Indicators:**
- Unusual network traffic masquerading as telemetry from game backend servers.
- Unexpected delays during the initialization of `Newtonsoft.Json`.
## Associated Threat Actors
- **MagicalPuff96** (NuGet account handle used to publish the packages).
## Detection Methods
- **Signature-based detection:** Scanning for the specific typosquatted package name `Newtonsoftt.Json.Net` within project dependency files (`.csproj`, `packages.config`, `project.assets.json`).
- **Behavioral detection:** Monitoring for unexpected external connections to the IP `185.126.237[.]64` or identifying the specific `X-Seq-ApiKey` header in outbound traffic.
- **Audit Logs:** Checking NuGet package download logs for entries from the publisher "MagicalPuff96."
## Mitigation Strategies
- **Removal:** Immediately uninstall the `Newtonsoftt.Json.Net` package and replace it with the legitimate `Newtonsoft.Json`.
- **Dependency Pinning:** Use a `packages.lock.json` file to ensure only verified, specific versions of dependencies are used.
- **Network Filtering:** Block the known C2 IP address at the firewall/EDR level.
- **Code Review:** Inspect internal "Crash" game logic for unauthorized patches or hooks if the package was inadvertently introduced to production.
## Related Tools/Techniques
- **Newtonsoft.Json:** The legitimate library that was forked and trojanized.
- **ConfuserEx:** An open-source protector for .NET applications used by the attacker for obfuscation.
- **Typosquatting:** The broader technique of registering deceptive names to misdirect users.