Agentic AI-Driven Spring Batch Intrusion + CoGUI/CoAceV/CoFish_Ws Phishing Kit Disruption: OTX Pulse Analysis — Enterprise Detection Pack | Security Arsenal

Two live OTX pulses published 2026-10-15 represent converging threat fronts: (1) the first confirmed large-language-model-driven agentic attack achieving full server takeover via an unauthenticated Spring Batch job-submission endpoint, and (2) a coordinated disruption of three Chinese-language phishing kits — CoGUI, CoAceV, and CoFish_Ws — operated by the YAM Store cybercriminal ecosystem. Both threaten credential integrity and internet-facing application infrastructure.

Threat Summary

These pulses collectively expose two structural shifts in the credential-theft landscape:

Pulse 1 — Agentic AI Intrusion. ReliaQuest's investigation documents the first confirmed incident where LLM-driven AI agents executed substantial portions of a real-world attack. Within 24 hours of gaining access, adversaries exploited an exposed, unauthenticated job-submission feature on an Apache Tomcat server running Spring Batch. Critically, the attack required no zero-days, no authentication bypass, and no novel malware — just an exposed endpoint and an AI agent orchestration platform called Cairn (open-source) automating reconnaissance, exploitation decisions, and privilege escalation. The identified IOCs (204.194.54.240, 204.194.55.189, 94.177.131.113) represent attacker-controlled infrastructure used during the intrusion. This is a milestone event: agentic AI collapsed the attack lifecycle from weeks to under 24 hours, automating decisions traditionally requiring human operators.

Pulse 2 — Phishing Kit Disruption. A coordinated action (reported by Proofpoint) targeted YAM Store, a Chinese-speaking cybercriminal operation running three major phishing kits: CoGUI, CoAceV, and CoFish_Ws. Collectively these kits distributed hundreds of millions of credential-phishing messages impersonating 66 brands — primarily consumer and finance companies — with a heavy focus on Japanese organizations. The kits harvest usernames, passwords, and payment card data. IOCs reveal a consistent luring pattern: typosquatted domains and URLs embedding legitimate Japanese municipal/brand strings (e.g., lygyaou.com/9AioLNhtdi.kumamoto-city.jp, paidy.farradae.com/paidy/ubmissionsjp) to mimic Paidy (Japanese BNPL service) and Kumamoto City. Note the typo ubmisionsjp/ubmissionsjp — a durable fingerprint for content-based detection. Targeted sectors span finance, healthcare, government, education, and manufacturing across the US, Australia, Italy, and Japan.

Collective objective: mass credential harvesting and infrastructure compromise. Disruption actions degrade — but do not eliminate — kit operators; expect infrastructure regeneration under new domains within days.

Threat Actor / Malware Profile

YAM Store (CoGUI / CoAceV / CoFish_Ws Phishing Kits)

Distribution method: High-volume phishing messages (email/SMS/smishing) impersonating 66 consumer and finance brands; Japanese-language lures targeting payment services (Paidy) and municipal government portals.
Payload behavior: Credential-harvesting landing pages clone legitimate login and payment flows; capture username, password, and payment card details in multi-step forms. Kit-generated URLs use randomized path tokens (e.g., /9AioLNhtdi., /BCuXkTPfKZ., /1DWSd1DeDf.) prefixed to spoofed legitimate domains.
C2 / exfiltration: Harvested credentials are POSTed to kit-controlled collector endpoints on disposable domains (lygyaou.com, kenandy.shop, new-app-haixing.com, farradae.com, ylhgkj.com). Kits rotate domains aggressively; seized domains are re-registered under new TLDs.
Persistence: None on victim endpoint — persistence lives in the kit operator's domain-registration pipeline and victim contact lists.
Anti-analysis: Randomized URL path tokens defeat naive URL blocklists; brand-string embedding (e.g., kumamoto-city.jp appended to malicious FQDN path) evades keyword filters; geo-fencing and bot-scanner detection are standard in this kit family.

Agentic AI Intrusion (Cairn Orchestration)

Distribution / access vector: Unauthenticated Spring Batch job-submission endpoint on internet-exposed Apache Tomcat. No exploit required — feature abuse.
Payload behavior: LLM-driven agents (orchestrated via Cairn) autonomously perform reconnaissance, craft and submit malicious job parameters, escalate privileges, and execute post-exploitation — compressing the intrusion lifecycle to <24 hours.
C2 communication: Observed attacker infrastructure: 204.194.54.240, 204.194.55.189 (same /23 block), 94.177.131.113. Expect outbound beacons and tooling retrieval from these hosts.
Persistence mechanism: Likely web-tier persistence — malicious Spring Batch job definitions, deployed WAR/web shells in Tomcat webapps directories, or scheduled job executions submitted through the same exposed feature.
Anti-analysis: Speed is the evasion: machine-pace execution outruns human SOC response windows. Agent-driven traffic may blend with legitimate automation, and no malware artifacts may exist on disk (living-off-the-feature).

IOC Analysis

Indicator types present:

IPv4 (3): 204.194.54.240, 204.194.55.189, 94.177.131.113 — attacker C2/staging infrastructure from the agentic intrusion. Block at egress firewall, proxy, and EDR network controls. Pivot on the 204.194.54.0/23 range for passive DNS and netflow hunting.
Domains (4 shown): lygyaou.com, kenandy.shop, new-app-haixing.com, ylhgkj.com (+ farradae.com embedded in URLs) — phishing kit landing/collector infrastructure. Sinkhole or DNS-block; add to secure web gateway category overrides.
URLs (5 shown): Full phishing URLs including spoofed path structures. Operationalize as pattern detections, not exact-match blocks: the token *.kumamoto-city.jp appended after a random string on a non-Japanese-TLD domain, and the path typo ubmisionsjp/ubmissionsjp under /paidy/, are high-fidelity signatures reusable against regenerated infrastructure.

SOC operationalization:

Ingest all IOCs into your TI platform (MISP/OpenCTI) tagged by pulse; push IPs to firewall/proxy blocklists and domains to DNS filtering (RPZ).
Retrospective hunt: query proxy, DNS, and netflow logs for 90 days of historical hits — phishing kit victims may have submitted credentials weeks ago.
Treat any confirmed connection to phishing kit domains as a credential compromise event — force password reset and review MFA/conditional-access logs for the affected user.
Tooling: YARA/Sigma for endpoint, Suricata/Zeek for network patterns, urlscan.io and VirusTotal for URL detonation, Shodan/Censys for C2 infrastructure pivoting on the 204.194.54.0/23 block.

Detection Engineering

YAML

---
title: Unauthenticated Spring Batch Job Submission Followed by Child Process Execution
id: 8f3a1c2e-9d4b-4e7a-b1c5-2a6f8e9d0c11
status: experimental
description: Detects Tomcat/JVM processes spawning shells or scripting interpreters, consistent with exploitation of an exposed Spring Batch job-submission endpoint as documented in the agentic AI (Cairn) intrusion pulse.
author: Security Arsenal Threat Intelligence
references:
  - https://reliaquest.com/blog/threat-spotlight-how-ai-agents-turned-one-exposed-endpoint-into-a-server-takeover
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\java.exe'
      - '\javaw.exe'
      - '\tomcat9.exe'
      - '\tomcat8.exe'
      - '\commons-daemon.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate Spring Batch jobs invoking system commands; baseline and whitelist known job definitions
level: high
tags:
  - attack.execution
  - attack.t1059
  - attack.t1190
---
title: Agentic Intrusion C2 Communication to Known Attacker Infrastructure
id: 7c2b4d1f-3e5a-4f6c-9a2b-1d8e7c5f4a22
status: experimental
description: Detects network connections to IPv4 indicators associated with the Cairn AI-agent-orchestrated server takeover documented in OTX pulse of 2026-10-15.
author: Security Arsenal Threat Intelligence
references:
  - https://reliaquest.com/blog/threat-spotlight-how-ai-agents-turned-one-exposed-endpoint-into-a-server-takeover
logsource:
  category: network_connection
  product: windows
detection:
  selection_ip:
    DestinationIp:
      - '204.194.54.240'
      - '204.194.55.189'
      - '94.177.131.113'
  condition: selection_ip
falsepositives:
  - Unlikely; infrastructure attributed to active intrusion
level: critical
tags:
  - attack.command_and_control
  - attack.t1071
---
title: CoGUI/CoAceV/CoFish_Ws Phishing Kit Infrastructure Access
id: 5e1a9b3d-7f2c-4a8e-b6d4-3c9f1e7a2b33
status: experimental
description: Detects DNS queries or web access to domains and URL path patterns used by YAM Store phishing kits (CoGUI, CoAceV, CoFish_Ws) targeting Japanese consumer/finance brands. Includes spoofed kumamoto-city.jp path embedding and Paidy lure typo fingerprints.
author: Security Arsenal Threat Intelligence
references:
  - https://www.proofpoint.com/us/blog/threat-insight/disruption-targets-major-chinese-language-phishing-kits-japanese-focus
logsource:
  category: dns
detection:
  selection_domain:
    query|contains:
      - 'lygyaou.com'
      - 'kenandy.shop'
      - 'new-app-haixing.com'
      - 'farradae.com'
      - 'ylhgkj.com'
  condition: selection_domain
falsepositives:
  - None expected; domains are dedicated phishing infrastructure
level: high
tags:
  - attack.initial_access
  - attack.t1566
  - attack.t1071.001

KQL — Microsoft Sentinel / Defender

// Hunt: Agentic intrusion C2 + phishing kit infrastructure across network and DNS telemetry
let c2_ips = dynamic(["204.194.54.240", "204.194.55.189", "94.177.131.113"]);
let phish_domains = dynamic(["lygyaou.com", "kenandy.shop", "new-app-haixing.com", "farradae.com", "ylhgkj.com"]);
union isfuzzy=true
    (DeviceNetworkEvents
    | where TimeGenerated > ago(90d)
    | where RemoteIP in (c2_ips)
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort, ActionType, Hunt="AgenticIntrusionC2"),
    (DeviceNetworkEvents
    | where TimeGenerated > ago(90d)
    | where RemoteUrl has_any (phish_domains)
        or RemoteUrl contains "ubmisionsjp"
        or RemoteUrl contains "ubmissionsjp"
        or (RemoteUrl contains ".kumamoto-city.jp" and RemoteUrl !contains "kumamoto-city.jp/")
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteUrl, ActionType, Hunt="PhishingKitAccess"),
    (DeviceProcessEvents
    | where TimeGenerated > ago(90d)
    | where InitiatingProcessFileName in~ ("java.exe", "javaw.exe", "tomcat9.exe")
    | where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "rundll32.exe", "certutil.exe")
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName, Hunt="SpringBatchChildProc")
| order by TimeGenerated desc

PowerShell

# Security Arsenal IOC Hunt - Agentic Intrusion + CoGUI Phishing Kit Artifacts
# Run elevated on endpoints and Tomcat servers. Outputs findings to CSV.

$report = @()

# 1. Check active/recent TCP connections to agentic intrusion C2 infrastructure
$c2IPs = @("204.194.54.240", "204.194.55.189", "94.177.131.113")
Get-NetTCPConnection | Where-Object { $c2IPs -contains $_.RemoteAddress } | ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    $report += [PSCustomObject]@{
        Type = "C2-Connection"; Indicator = $_.RemoteAddress
        Detail = "PID $($_.OwningProcess) [$($proc.ProcessName)] state $($_.State)"
    }
}

# 2. Hunt Tomcat/Spring Batch child-process artifacts in process command-line WMI history
Get-CimInstance Win32_Process | Where-Object {
    $_.CommandLine -match "tomcat|spring" -and
    $_.Name -match "cmd.exe|powershell.exe|pwsh.exe|rundll32.exe|certutil.exe"
} | ForEach-Object {
    $report += [PSCustomObject]@{
        Type = "Suspicious-ChildProcess"; Indicator = $_.Name; Detail = $_.CommandLine
    }
}

# 3. Check Tomcat webapps directories for recently dropped WAR/web shell artifacts
$tomcatPaths = @("C:\Program Files\Apache Software Foundation", "C:\tomcat", "D:\tomcat")
foreach ($base in $tomcatPaths) {
    if (Test-Path $base) {
        Get-ChildItem -Path $base -Recurse -Include *.war,*.jsp,*.jspx -ErrorAction SilentlyContinue |
            Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) } | ForEach-Object {
                $report += [PSCustomObject]@{
                    Type = "WebShell-Candidate"; Indicator = $_.FullName
                    Detail = "Modified $($_.LastWriteTime)"
                }
            }
    }
}

# 4. Review DNS client cache for phishing kit domain hits (proxy for past user clicks)
$phishDomains = @("lygyaou.com", "kenandy.shop", "new-app-haixing.com", "farradae.com", "ylhgkj.com")
Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object {
    $entry = $_.Name; $phishDomains | Where-Object { $entry -like "*$_*" }
} | ForEach-Object {
    $report += [PSCustomObject]@{
        Type = "Phishing-DNSCache"; Indicator = $_.Name; Detail = "Data: $($_.Data)"
    }
}

# 5. Check scheduled tasks for persistence registered in the last 14 days
Get-ScheduledTask | Where-Object { $_.Date -gt (Get-Date).AddDays(-14) } | ForEach-Object {
    $report += [PSCustomObject]@{
        Type = "New-ScheduledTask"; Indicator = $_.TaskName; Detail = $_.TaskPath
    }
}

if ($report.Count -gt 0) {
    $report | Format-Table -AutoSize
    $report | Export-Csv -Path ".\otx_hunt_$(Get-Date -Format 'yyyyMMdd_HHmm').csv" -NoTypeInformation
    Write-Host "[!] $($report.Count) findings exported. Escalate C2-Connection and WebShell-Candidate hits immediately." -ForegroundColor Red
} else {
    Write-Host "[+] No indicators found on this host." -ForegroundColor Green
}

Response Priorities

Immediate (0-4 hours):

Block 204.194.54.240, 204.194.55.189, 94.177.131.113 at egress firewall and proxy; block lygyaou.com, kenandy.shop, new-app-haixing.com, farradae.com, ylhgkj.com via DNS RPZ and secure web gateway.
Inventory all internet-facing Apache Tomcat / Spring Batch instances; disable or authenticate the job-submission endpoint immediately — this attack needs no exploit, only exposure.
Execute the PowerShell hunt on Tomcat servers; review webapps directories for unauthorized WAR/JSP deployments.

24 hours:

For any user with confirmed phishing-kit domain contact: force password reset, revoke active sessions and refresh tokens, review MFA and conditional-access sign-in logs for anomalous Japanese-impersonation-brand session origin. Assume harvested credentials are already tested against VPN, SSO, and email.
Run the Sentinel KQL hunt across 90 days; correlate PhishingKitAccess hits with identity events.
Audit Spring Batch job history/logs for job submissions originating from external IPs or containing shell invocations.

1 week:

Remove Spring Batch and management endpoints from internet exposure entirely — place behind VPN/allow-listing with mutual TLS; enforce authentication on all job-submission APIs.
Deploy the Sigma rules to production SIEM; add the phishing URL patterns (ubmisionsjp, *.kumamoto-city.jp path spoofing) to email gateway and proxy content filters as durable kit fingerprints resilient to domain rotation.
Establish detection baselines for JVM-spawned child processes; alert on machine-pace attack sequences (recon-to-escalation under minutes) as an agentic-AI behavioral signature.
Brief executives: agentic AI has compressed intrusion timelines below human response windows — automated containment playbooks are now mandatory, not optional.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub

Agentic AI-Driven Spring Batch Intrusion + CoGUI/CoAceV/CoFish_Ws Phishing Kit Disruption: OTX Pulse Analysis — Enterprise Detection Pack