GCVE-110-OSM-2026-9572

This is a typosquat of the popular `requests` library (Levenshtein distance 1: 'reguestsc' vs 'requests') that copies the legitimate package's metadata wholesale but injects a dropper payload into `src/requests/__init__.py`. The modified `__init__.py` contains a hardcoded URL `http://31.76.101.19:8080/Group.exe` — a raw IP serving a Windows executable — combined with `subprocess.Popen(` in the same file, constituting a classic fetch-and-execute dropper pattern. Cyrillic comments in that same file (`# Импортируем requests внутри, чтобы не сломать основной импорт`) indicate the Russian-speaking attacker was aware they were modifying the original requests source. The publisher 'Bibinto' has zero prior packages, no repository link, and the package claims to be version 2.34.2 of a library that doesn't exist under this name — all consistent with a newly-created malicious account. The attacker model is straightforward: victim installs the typosquat, import triggers `__init__.py`, `Group.exe` is downloaded from the C2 and executed. ENTRY tests/__init__.py (module-import: 4) DESTINATION - 8 exfil (custom-c2) - 4 c2 (urls, domains) (values recorded in verified_iocs) EXFIL - Network Request in PKG-INFO: "requests.get(" - Network Request in src/reguestsc.egg-info/PKG-INFO: "requests.get(" - Network Request in src/requests/__init__.py: "requests.get(" - Suspicious Domain in src/requests/__init__.py: "http://31.76.101.19" - Network Request in src/requests/api.py: "request('GET', 'https:" - System Information Collection in src/requests/help.py: "platform.system()" - Network Request in src/requests/models.py: "Request('GET', 'https:" OBFUSCATION - Decoded Base64 Content in tests/certs/mtls/client/client.csr (x5) - Decoded Base64 Content in tests/certs/expired/ca/ca.crt - Decoded Base64 Content in tests/certs/expired/server/server.pem (x2) - Decoded Base64 Content in tests/certs/mtls/client/client.pem (x2) - Decoded Base64 Content in tests/certs/valid/server/server.pem (x2) - recovered 2 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Shell Command Execution in src/requests/__init__.py: "subprocess.Popen(" PAYLOAD FILES tests/certs/mtls/client/client.csr