Affected Systems
NuGet package "Newtonsoftt.Json.Net" versions 11.0.4, 11.0.5, 11.0.7, 11.0.8, 11.0.9, 11.0.10, and 11.0.11 (typosquat of Newtonsoft.Json). Primary target: Digitain FG-Crash betting game backend. Downloaded ~1,200 times. Package unlisted but artifacts remain downloadable.
Exploitation Status
Active exploitation confirmed. Malicious package published between August 13 and October 10, 2025. Three generations of the trojan deployed, with exfiltration to 185.126.237[.]64:5341 using header "X-Seq-ApiKey: theperfectheist2025". Digitain confirmed awareness and remediation in progress.
Business Impact
Targeted supply chain attack designed to rig live betting game results on Digitain platform. Non-targeted developers who installed via typo receive a functional Newtonsoft.Json library with no visible malicious behavior unless running Digitain's FG-Crash backend. Malware activates only when JsonConvert.DefaultSettings is assigned and specific game backend methods are present. No credential theft, persistence, or lateral movement capabilities. Package metadata leaks internal Digitain repository URL, indicating insider access to source code. Full exposure extent unknown.
Urgency
🟠Within 24 hours
Recommended Actions
- Audit all .NET projects for dependency on 'Newtonsoftt.Json.Net' (note double 't') and remove immediately if present
- Block C2 IP address 185.126.237[.]64 port 5341 at network perimeter and monitor for outbound connections using X-Seq-ApiKey header 'theperfectheist2025'
- Pin Newtonsoft.Json to known-good versions (e.g., 13.0.3) using packages.lock.json and enforce package integrity checks in CI/CD pipelines
- For Digitain customers: contact vendor for incident-specific guidance and review FG-Crash backend logs for anomalous JsonConvert.DefaultSettings initialization or rigged game results between August-October 2025
- Implement NuGet package verification policies to flag typosquatting attempts and require manual approval for new dependencies resembling high-use libraries