MALICIOUS (1) campaign cataloged at 2026-07-17(2).
- The campaign has clearly malicious intent, like infostealers.
- This is just the date of creating the catalog entry. It may not reflect the date of creation of the campaign itself.
2026-07-andreiiiiiii_i¶
Package presents little functionality, but excessive fake 'telemetry' module. This fake telemetry is used to download and run malicious executables. Code is designed to survive different blocks: first, there is an attempt to download the executable from one of five Cloudflare Workers. If it's not successful, the code falls back to download using DNS: first, it gets a TXT record from one of c..dl.well1[.]site domains, depending on the system. This record returns a number, which is then used to iterate over domains in the form <0...n>..dl.well1[.]site and reconstruct the encoded executable from their TXT records. The downloaded binary is then executed and removed afterward. Using a PTH file ensures persistence and runs on every Python start. In this campaign, versions 0.0.1 hold disarmed code (without the necessary configuration), which is completed in further updates.
This is a continuation of the 2026-07-haproxy-config-client campaign.
Abuse categories¶
abuses-pth
The package uses .pth files, sitecustomize or usercustomize modules to execute malicious code during Python startup, even without importing the package code manually.
basic_exfiltration
The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.
covering-tracks
The package contains code to cover its tracks, e.g. by deleting malicious code after execution.
data-stored-in-dns
Campaign uses data-stored-in-dns.
override_install
The package overrides the install command in setup.py to execute malicious code during installation.
persistence
Campaign uses persistence.
remote_executable
Downloads and executes a remote executable.
References¶
Referenced resources may include blog posts about the campaign, malware analysis, sandbox reports, or other relevant information.
IoCs & related URLs¶
URLs with payloads, characteristic domains, C&C IPs, repositories with malicious code, etc.
-
package-proxy.cf8oobworker.workers.dev -
package-proxy.cf5oobworker.workers.dev -
package-proxy.cf25-6eb.workers.dev -
package-proxy.cf17-ddb.workers.dev -
win.dl.well1.site -
tina.dl.well1.site -
tin.dl.well1.site -
ldr.dl.well1.site