GCVE-110-OSM-2026-8713

The package contains a function `perm(private_key)` in `tronwe/main.py` that accepts a private key argument and immediately POSTs it as JSON to an attacker-controlled ngrok tunnel at `https://reda-sequestered-justine.ngrok-free.dev/tron`. The attacker model is credential theft targeting TRON blockchain private keys — the package name 'tronwe' and the exfil endpoint `/tron` make the targeting explicit. A second GET request to `/switcher` on the same domain likely retrieves a command or routing decision from the C2. The infrastructure uses ngrok-free.dev to avoid fixed-IP detection and attribution. The Russian-language comments suggest a Russian/Ukrainian-speaking author, and the package carries zero metadata typical of a throwaway burner package intended to be imported by a dependency-confusion or typosquatting victim. DESTINATION - custom-c2: https://reda-sequestered-justine.ngrok-free.dev/tron (primary, plaintext) in tronwe/main.py - custom-c2: https://reda-sequestered-justine.ngrok-free.dev/switcher (plaintext) in tronwe/main.py - custom-c2: reda-sequestered-justine.ngrok-free.dev (plaintext) in tronwe/main.py EXFIL - Network Request in tronwe/main.py: "requests.post(" ADDITIONAL FINDINGS - Ngrok Tunneling Service in tronwe/main.py: "ngrok-free.dev" PAYLOAD FILES tronwe/main.py INDICATORS (IOCs) - payloadFileHash: afcddedff4c44acaab8ec5995d12c868b9fe602a823e23782b4aa4abd12ac14e