2CLoader, Vidar, Remus & MadApe: Credential-Theft Campaigns, Supply-Chain SSH Backdoor and Zimbra Exploitation — OTX Enterprise Detection Pack

---
title: 2CLoader / Vidar / Remus C2 Beaconing to Suspicious API Path
id: 9f1c2a11-2c10-4a10-9a10-2cl0ader0001
status: experimental
description: Detects outbound HTTPS beaconing matching 2CLoader-delivered Vidar/Remus/XWorm C2 infrastructure observed in OTX pulse data.
author: Security Arsenal
references:
  - https://www.zscaler.com/blogs/security-research/2cloader-new-malware-loader-delivering-vidar-and-remus
date: 2026/10/30
logsource:
  category: proxy
  product: zeek
detection:
  selection_host:
    cs-host: 'aware-cr1.com'
  selection_path:
    cs-uri-query|contains: '/api/beacon'
  condition: selection_host or selection_path
falsepositives:
  - Legitimate APIs using /api/beacon naming (rare; whitelist known apps)
level: high
tags:
  - attack.command_and_control
  - attack.t1071.001
---
title: Suspicious SSH Key Insertion by Non-System Process (Trojanized Extension Backdoor)
id: 8a7b6c55-ssh0-4bck-9d00-extb0ckd0002
status: experimental
description: Detects writes to authorized_keys by editors/extensions or script interpreters, consistent with the trojanized Claude Code extension 'svc-telemetry' SSH backdoor.
author: Security Arsenal
references:
  - https://opensourcemalware.com/blog/trojanized-claude-code-extension-plants-persistent-ssh-backdoor
date: 2026/10/30
logsource:
  category: file_event
  product: windows
detection:
  selection_target:
    TargetFilename|endswith:
      - '\.ssh\authorized_keys'
      - '/.ssh/authorized_keys'
  selection_img:
    Image|endswith:
      - '\node.exe'
      - '\Code.exe'
      - '\Cursor.exe'
      - '\powershell.exe'
      - '\cmd.exe'
  condition: all of selection_*
falsepositives:
  - DevOps automation deploying keys (restrict to approved management hosts)
level: high
tags:
  - attack.persistence
  - attack.t1098.004
  - attack.t1195.002
---
title: Zimbra Webserver Spawning Shell — CVE-2026-73570 Post-Exploitation
id: 7c6d5e44-z1mb-4r4a-w3b5-h3llinj0003
status: experimental
description: Detects Java/Zimbra processes spawning shells or script interpreters, consistent with unauthenticated command injection and JSP webshell (China Chopper/Godzilla/Looptik) deployment.
author: Security Arsenal
references:
  - https://www.microsoft.com/en-us/security/blog/2026/09/30/unauthenticated-command-injection-on-internet-facing-mail-servers-tracking-cve-2026-73570/
date: 2026/10/30
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/java'
      - '/zmmailboxd'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/dash'
      - '/python'
      - '/perl'
      - '/curl'
      - '/wget'
  condition: all of selection_*
falsepositives:
  - Zimbra maintenance scripts (review parent command line)
level: critical
tags:
  - attack.execution
  - attack.t1190
  - attack.t1505.003

// Security Arsenal — Unified hunt: 2CLoader/Vidar C2, MadApe phishing infra, Zimbra exploitation, SSH backdoor
let MadApeDomains = dynamic(["sucdens.com","cepoffices.com","zakosta.info","nsboards.com","adastraerrans.com","travestiilan.com","nysndigital.com","powerlivings.com"]);
let ZimbraC2 = dynamic(["psk1zim.abrdns.com","tls.psk1zim.abrdns.com"]);
let C2Hosts = dynamic(["aware-cr1.com"]);
let NetworkHits =
    DeviceNetworkEvents
    | where Timestamp > ago(14d)
    | where RemoteUrl has_any (MadApeDomains) or RemoteUrl has_any (ZimbraC2) or RemoteUrl has_any (C2Hosts)
    | project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort
    | extend Hunt = "Network-IOC";
let ProcessHits =
    DeviceProcessEvents
    | where Timestamp > ago(14d)
    | where (InitiatingProcessFileName has_any ("java","zmmailboxd") and FileName in~ ("bash","sh","dash","python","perl","curl","wget"))
       or ProcessCommandLine has_any ("authorized_keys","svc-telemetry","Hell","devicecode")
    | project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
    | extend Hunt = "Process-Behavior";
union NetworkHits, ProcessHits
| sort by Timestamp desc

# Security Arsenal — Multi-pulse IOC & artifact hunt (run elevated on endpoints/servers)
# Covers: 2CLoader/Vidar/Remus hashes, trojanized extension SSH backdoor, Zimbra webshell infra, MadApe phishing domains
$ErrorActionPreference = 'SilentlyContinue'

$hashes = @(
  '06185d74edbdc06f99095e96f74aa2e49a1cda2d02a294c11a9ac35a0231075e',
  '246717653bc2ae2e09036bac56c9d79940c652972a73f4c6aa9b925c28cce095',
  '1337ed6fe9c6205b569670a40eab42b51ba69c5c1724d61474e8595acd90ecfb',
  '2d43d592630ad1e012da63ef7279f95dd4a8e94964e12ca2f996051875574fa6',
  '066d83b98a2081e0bb075c94376aebc9b0fd6499025cab1762d83bbb4d7576c6',
  '18756b75afedee74bbf49832a1b1dada4961672c41d595be5c1bbe75709de927',
  '7e0a52885fadee05544a9e99eb18c792bec05900a5e1a66d68f8383decb0e278',
  'ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15',
  'dee5af1c0f76b45d28bafd6e60c07bb8e391d98addf81ef8f13d073acdb3c48a',
  'aea991f694911e321b0ab97534f2ad0291c392c0a43dabff664c563618bd036d'
)

$badDomains = @('aware-cr1.com','sucdens.com','cepoffices.com','zakosta.info','nsboards.com','adastraerrans.com','travestiilan.com','nysndigital.com','powerlivings.com','psk1zim.abrdns.com')

Write-Host "=== [1] User-profile hash sweep (Downloads/Desktop/Temp) ===" -ForegroundColor Cyan
Get-ChildItem "$env:USERPROFILE\Downloads","$env:USERPROFILE\Desktop","$env:TEMP" -Recurse -File -ErrorAction SilentlyContinue |
  ForEach-Object { $h = (Get-FileHash $_.FullName -Algorithm SHA256).Hash
    if ($hashes -contains $h) { Write-Host "[HIT] $($_.FullName)  $h" -ForegroundColor Red } }

Write-Host "=== [2] Trojanized extension artifacts: authorized_keys / svc-telemetry ===" -ForegroundColor Cyan
Get-ChildItem "$env:USERPROFILE\.ssh\authorized_keys","C:\Users\*\.ssh\authorized_keys" -ErrorAction SilentlyContinue |
  ForEach-Object { $c = Get-Content $_.FullName
    if ($c -match 'svc-telemetry') { Write-Host "[HIT] Backdoored key in $($_.FullName)" -ForegroundColor Red } }
Get-ChildItem "$env:USERPROFILE\.cursor\extensions" -Recurse -Filter extension.js -ErrorAction SilentlyContinue |
  ForEach-Object { if ((Get-Content $_.FullName -Raw) -match 'authorized_keys|svc-telemetry') {
    Write-Host "[HIT] Suspicious extension loader: $($_.FullName)" -ForegroundColor Red } }

Write-Host "=== [3] Persistence check: Run keys & scheduled tasks with script interpreters ===" -ForegroundColor Cyan
Get-ItemProperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run','HKLM:\Software\Microsoft\Windows\CurrentVersion\Run' |
  Out-String | Select-String -Pattern 'powershell|wscript|mshta|rundll32' -AllMatches |
  ForEach-Object { Write-Host "[REVIEW] $($_.Line)" -ForegroundColor Yellow }
Get-ScheduledTask | Where-Object { $_.Actions.Execute -match 'powershell|wscript|mshta' } |
  ForEach-Object { Write-Host "[REVIEW] Task: $($_.TaskName) -> $($_.Actions.Execute)" -ForegroundColor Yellow }

Write-Host "=== [4] Network IoC check: active & cached connections to C2/phishing domains ===" -ForegroundColor Cyan
Get-NetTCPConnection -State Established |
  ForEach-Object { try { $r = Resolve-DnsName -Name $_.RemoteAddress -ErrorAction Stop } catch { $null } } | Out-Null
Get-DnsClientCache | Where-Object { $e=$_.Entry; $badDomains | Where-Object { $e -like "*$_*" } } |
  ForEach-Object { Write-Host "[HIT] DNS cache: $($_.Entry) -> $($_.Data)" -ForegroundColor Red }

Write-Host "=== Hunt complete. Investigate any [HIT] entries immediately. ===" -ForegroundColor Green