Aurora Ransomware's AI-Assisted ESXi Exploitation, Star Blizzard Espionage & PHP2Shell Extortion: Multi-Vector Threat Analysis — OTX Detection Pack

Threat Summary

Three convergent campaigns surfaced in late-October OTX telemetry illustrate a rapidly maturing threat landscape where automation, artificial intelligence, and shared infrastructure lower the barrier to high-impact intrusions.

Aurora Ransomware — active since April 2026 — represents the commoditization of hypervisor-level destruction. The group deploys a Linux-native ransomware payload purpose-built for VMware ESXi environments, leveraging ChaCha20 symmetric encryption wrapped with RSA-4096 public-key cryptography. Most notably, the operators abuse Cursor Agent with Claude — legitimate AI-powered penetration testing and vulnerability research tooling — to automate target reconnaissance, exploit validation, and post-compromise lateral movement within virtualized datacenters. This marks an operational shift where ransomware affiliates utilize autonomous AI agents not merely for code generation, but for real-time tactical decision-making during intrusion lifecycles. Confirmed targeting spans the United States, Argentina, Austria, Germany, Israel, and Spain.

Star Blizzard (also tracked as Callisto, SEABORGIUM, or BlueCharlie) — attributed to the Russian Federal Security Service (FSB) Center 18 — continues its decade-long espionage campaign against NATO governments, defense contractors, NGOs, and academic institutions. The group has evolved beyond simple credential harvesting into sophisticated hack-and-leak operations utilizing a modular malware arsenal including SPICA, LOSTKEYS, EvilGinx, and GHOSTBLADE. Current campaigns exploit CVE-2022-30190 (Follina), CVE-2023-36884, and CVE-2024-4947, delivering adversary-in-the-middle (AiTM) phishing frameworks to bypass multi-factor authentication and establish persistent access to email infrastructure.

PHP2Shell Extortion Campaign — attributed to threat actor kkkkevin777 — demonstrates opportunistic exploitation of web-facing vulnerabilities (CVE-2026-109618, CVE-2026-109619) targeting Japanese real estate and financial services. Between October 9-11, 2026, the actor compromised a Japanese real estate services firm and pivoted to nearly 20 related properties via shared hosting credentials, exfiltrating 16,061 customer records before deploying web shells for persistent access.

Collectively, these pulses reveal adversaries prioritizing virtualization infrastructure, identity systems, and edge web applications — often utilizing AI automation or commodity exploit kits to accelerate the time from initial access to objective completion.

Threat Actor / Malware Profile

Aurora Ransomware (Hypervisor Targeting)

Distribution & Initial Access: Aurora affiliates leverage AI-assisted exploitation frameworks — specifically Cursor Agent integrated with Claude — to identify and weaponize ESXi vulnerabilities at scale. Rather than manual vulnerability validation, operators feed target ranges into the AI agent, which autonomously probes management interfaces (vCenter, ESXi Host Client), tests default credentials, and exploits known misconfigurations. Initial access vectors include exposed vCenter Server instances, CVE-2024-37085 (Active Directory integration authentication bypass), and compromised MSP credentials.

Payload Behavior: The Linux binary targets the ESXi shell environment, terminating virtual machines via vim-cmd API calls to release file locks before encryption. It employs ChaCha20 stream cipher for bulk file encryption (avoiding the resource overhead of AES on large VMDK files) with RSA-4096 key wrapping for per-file session keys. The malware appends extensions including .Aurora or .Roarur and drops ransom notes (#DECRYPT MY FILES#.txt) in affected directories. Anti-analysis features include environment checks to identify sandboxes, ESXi-specific process injection, and deletion of shadow copies via vssadmin analogs within guest VMs.

C2 & Infrastructure: Aurora operates a dedicated data leak site accessible via Tor (ijexszhscln27nl263lmcd7tx3jttkhm4wjhd4e3y6r4csdbfyeprvid.onion). Command-and-control infrastructure observed includes 146.19.125.36, 81.177.215.15, 89.106.83.49, and 157.173.29.133 — primarily bulletproof hosting providers in Eastern Europe and Southeast Asia. The group leverages Hydraq and 9002 RAT for persistent access prior to ransomware deployment.

Persistence: Deployment of SSH keys to /etc/ssh/keys-root/authorized_keys, cron job creation for payload re-execution, and installation of systemd services masquerading as legitimate VMware services (e.g., vmware-vpxd, vpxa).

Star Blizzard (FSB Center 18)

Distribution: Highly targeted spear-phishing campaigns impersonating diplomatic contacts, academic colleagues, or IT support. Recent waves utilize EvilGinx2 — an AiTM phishing framework — to proxy legitimate Microsoft 365 and Google Workspace login portals, capturing session cookies and bypassing MFA.

Payload Behavior: The SPICA malware family (Rust-based backdoor) provides persistent access, while LOSTKEYS and COLDCOPY handle credential theft and data staging. GHOSTBLADE and BAITSWITCH serve as downloaders for secondary tooling. The actors demonstrate living-off-the-land tendencies, heavily utilizing PowerShell, WMI, and legitimate cloud storage (OneDrive, Dropbox) for exfiltration.

C2 & Infrastructure: C2 domains frequently utilize dynamic DNS providers and typo-squatted domains resembling legitimate Microsoft, Google, or ProtonMail properties (e.g., preentootmist.org, captchanom.top). Infrastructure often sits behind Cloudflare proxies to mask origin servers.

Persistence: Registry Run keys (HKCU\Software\Microsoft\Windows\CurrentVersion\Run), scheduled tasks with randomized names, and OAuth token abuse for persistent cloud access independent of password resets.

PHP2Shell (kkkkevin777)

Distribution: Exploitation of CVE-2026-109618 and CVE-2026-109619 — vulnerabilities in PHP-based content management systems and staging servers. The actor specifically targets shared hosting environments to maximize impact across multiple tenants.

Payload Behavior: Deployment of PHP web shells (likely WSO, b374k, or custom variants) enabling remote command execution, database dumping, and lateral movement via stored credentials in wp-config.php or similar configuration files. The actor utilizes curl and wget to pull additional payloads from staging infrastructure at 96.126.130.81.

C2 & Infrastructure: Direct IP communication with compromised staging servers; utilization of legitimate Japanese hosting providers to blend with regional traffic.

Persistence: Modification of existing PHP files to include backdoor functionality, creation of hidden admin users in CMS databases, and cron jobs for payload refresh.

IOC Analysis

The indicator set reflects a hybrid threat landscape requiring multi-layered detection strategies.

IPv4 Indicators (Network Infrastructure):

• Aurora Ransomware: 146.19.125.36, 81.177.215.15, 89.106.83.49, 157.173.29.133 (C2 and staging)
• PHP2Shell: 96.126.130.81 (staging/exploitation server)
• Star Blizzard: 103.245.231.248 (phishing/C2)

These IPs primarily represent bulletproof hosting and compromised VPS instances. SOC teams should implement deny-listing at the network perimeter, but recognize that Aurora and Star Blizzard rapidly rotate infrastructure. IP indicators are most effective when combined with JA3/JA3S fingerprinting and TLS certificate analysis to catch C2 traffic even when IPs change.

Domain Indicators:

• Aurora: Onion-based DLS (data leak site) — requires Tor gateway monitoring or DNS sinkholing for .onion resolution attempts within corporate networks (indicative of data staging for exfiltration).
• Star Blizzard: preentootmist.org, captchanom.top — AiTM phishing domains designed to appear legitimate. These warrant DNS filtering and TLS inspection to detect EvilGinx proxy patterns.

File Hash Indicators:

• SHA256: a4af136d159a8eb96b54924fa80355ca52874913301300f55af7d67ae97edcfe (Aurora ransomware binary)
• SHA256: 87138f63974a8ccbbf5840c31165f1a4bf92a954bacccfbf1e7e5525d750aa48 (Star Blizzard SPICA payload)
• MD5: a607384ce68144f2061a8b30cc65a6b8 (Aurora Linux variant)

Hashes are high-fidelity but volatile. Operationalize these via EDR blocklists (Microsoft Defender, CrowdStrike, SentinelOne) and file integrity monitoring on ESXi hosts. Note that Aurora operators likely recompile payloads per-victim, necessitating behavioral detection over static hash matching.

CVE References:

• CVE-2022-30190 (Follina), CVE-2023-36884, CVE-2024-4947 (Star Blizzard exploitation)
• CVE-2026-109618, CVE-2026-109619 (PHP2Shell web exploitation)

Vulnerability management teams should prioritize patching for these CVEs, but SOC analysts should also hunt for exploitation artifacts (e.g., ms-msdt: protocol abuse for Follina, suspicious PHP process spawning for CVE-2026-109618).

Operationalization Workflow:

1. Ingest IOCs into threat intelligence platforms (MISP, ThreatConnect, OpenCTI).
2. Enrich with passive DNS (PassiveTotal, SecurityTrails) to identify related infrastructure.
3. Block at email gateway (Star Blizzard phishing domains), web proxy (Aurora C2 IPs), and EDR (file hashes).
4. Hunt using behavioral analytics (detection engineering below) to catch variants that evade static IOCs.

Detection Engineering

---
title: Aurora Ransomware ESXi Encryption Execution
description: Detects Aurora ransomware encryption activity on VMware ESXi hosts via ChaCha20 cipher usage and VM termination
author: Security Arsenal Threat Intelligence
id: 8f9a1b2c-3d4e-5f6a-7b8c-9d0e1f2a3b4c
status: experimental
logsource:
    product: linux
    service: esxi
    category: process_creation
detection:
    selection_img:
        Image|endswith:
            - '/aurora'
            - '/roarur'
            - '/enc'
        CommandLine|contains:
            - 'chacha20'
            - 'rsa-4096'
            - '--encrypt'
            - '/vmfs/volumes'
    selection_vmkill:
        CommandLine|contains:
            - 'vim-cmd vmsvc/power.off'
            - 'esxcli vm process kill'
    condition: selection_img or selection_vmkill
falsepositives:
    - Legitimate ESXi administrative scripts
    - Backup software performing VM quiescence
level: high
tags:
    - attack.impact
    - attack.t1486
    - attack.t1490
    - attack.t1572
date: 2026/10/30
---
title: Star Blizzard Phishing C2 Communication
description: Detects network communication with known Star Blizzard (Callisto) C2 domains and AiTM phishing infrastructure
author: Security Arsenal Threat Intelligence
id: 2b3c4d5e-6f7a-8b9c-0d1e-2f3a4b5c6d7e
status: experimental
logsource:
    category: network_connection
    product: windows
detection:
    selection_domain:
        DestinationHostname:
            - 'preentootmist.org'
            - 'captchanom.top'
        DestinationIp:
            - '103.245.231.248'
    selection_useragent:
        UserAgent|contains:
            - 'EvilGinx'
            - 'COLDCOPY'
    condition: selection_domain or selection_useragent
falsepositives:
    - Security research infrastructure
level: high
tags:
    - attack.command_and_control
    - attack.t1071
    - attack.t1566
date: 2026/10/30
---
title: PHP2Shell Web Shell Deployment
description: Detects PHP2Shell web shell activity and post-exploitation on web servers
author: Security Arsenal Threat Intelligence
id: 4c5d6e7f-8a9b-0c1d-2e3f-4a5b6c7d8e9f
status: experimental
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection_uri:
        cs-uri-query|contains:
            - 'cmd='
            - 'shell'
            - 'wget'
            - 'curl'
        cs-uri-stem|endswith: '.php'
    selection_method:
        cs-method: 'POST'
    selection_upload:
        cs-uri-stem|contains:
            - '/uploads/'
            - '/images/'
            - '/tmp/'
        sc-status: 200
    condition: (selection_uri and selection_method) or selection_upload
falsepositives:
    - Legitimate file upload functionality
    - CMS administrative panels
level: medium
tags:
    - attack.persistence
    - attack.t1505.003
    - attack.t1105
date: 2026/10/30

// Microsoft Sentinel KQL Hunt — Aurora ESXi Targeting & Star Blizzard Phishing
// Timeframe: Last 14 days

let auroraIPs = dynamic(["146.19.125.36", "81.177.215.15", "89.106.83.49", "157.173.29.133"]);
let starblizzardIPs = dynamic(["103.245.231.248"]);
let php2shellIPs = dynamic(["96.126.130.81"]);
let maliciousDomains = dynamic(["preentootmist.org", "captchanom.top"]);

union isfuzzy=true
    (
    // Network connections to Aurora C2
    DeviceNetworkEvents
    | where TimeGenerated > ago(14d)
    | where RemoteIP in (auroraIPs)
    | project TimeGenerated, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, InitiatingProcessCommandLine
    | extend ThreatFamily = "Aurora Ransomware"
    ),
    (
    // Network connections to Star Blizzard C2 or phishing domains
    DeviceNetworkEvents
    | where TimeGenerated > ago(14d)
    | where RemoteIP in (starblizzardIPs) or RemoteUrl has_any (maliciousDomains)
    | project TimeGenerated, DeviceName, RemoteIP, RemoteUrl, InitiatingProcessFileName, InitiatingProcessCommandLine
    | extend ThreatFamily = "Star Blizzard"
    ),
    (
    // Network connections to PHP2Shell infrastructure
    DeviceNetworkEvents
    | where TimeGenerated > ago(14d)
    | where RemoteIP in (php2shellIPs)
    | project TimeGenerated, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, InitiatingProcessCommandLine
    | extend ThreatFamily = "PHP2Shell"
    ),
    (
    // ESXi VM termination behavior (Aurora precursor)
    DeviceProcessEvents
    | where TimeGenerated > ago(14d)
    | where FileName =~ "vim-cmd" or FileName =~ "esxcli"
    | where ProcessCommandLine has_any ("power.off", "vm process kill", "vmsvc")
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, AccountName
    | extend ThreatFamily = "Aurora ESXi Targeting"
    ),
    (
    // Star Blizzard EvilGinx AiTM indicators
    DeviceNetworkEvents
    | where TimeGenerated > ago(14d)
    | where RemoteUrl contains "login.microsoftonline.com" or RemoteUrl contains "accounts.google.com"
    | where InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe", "firefox.exe")
    | where RemoteIP in (starblizzardIPs)
    | project TimeGenerated, DeviceName, RemoteUrl, RemoteIP, InitiatingProcessFileName
    | extend ThreatFamily = "Star Blizzard AiTM"
    )
| summarize by TimeGenerated, DeviceName, ThreatFamily, RemoteIP, RemoteUrl, FileName, ProcessCommandLine
| order by TimeGenerated desc

# Security Arsenal — Multi-Threat IOC Hunt Script
# Checks for Aurora Ransomware, Star Blizzard persistence, and PHP2Shell artifacts
# Run as Administrator or SYSTEM on Windows; requires root for ESXi Linux checks

param(
    [switch]$CheckESXi = $false
)

$timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
Write-Host "[$timestamp] Starting threat hunt..." -ForegroundColor Cyan

# Known malicious file hashes
$maliciousHashes = @{
    "a4af136d159a8eb96b54924fa80355ca52874913301300f55af7d67ae97edcfe" = "Aurora Ransomware"
    "87138f63974a8ccbbf5840c31165f1a4bf92a954bacccfbf1e7e5525d750aa48" = "Star Blizzard SPICA"
    "a607384ce68144f2061a8b30cc65a6b8" = "Aurora Linux Variant"
}

# 1. Check for Star Blizzard persistence (Registry Run Keys)
Write-Host "`n[*] Checking Registry Run Keys for Star Blizzard persistence..." -ForegroundColor Yellow
$runKeys = @(
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce"
)

foreach ($key in $runKeys) {
    if (Test-Path $key) {
        $values = Get-ItemProperty -Path $key
        $values.PSObject.Properties | ForEach-Object {
            if ($_.Value -match "powershell|cmd|wscript|cscript|mshta|rundll32" -and $_.Value -match "http|ftp|\+\+") {
                Write-Host "[!] Suspicious Run Key found: $key -> $($_.Name): $($_.Value)" -ForegroundColor Red
            }
        }
    }
}

# 2. Check for Aurora Ransomware artifacts (File System & Network)
Write-Host "`n[*] Checking for Aurora Ransomware network connections..." -ForegroundColor Yellow
$auroraIPs = @("146.19.125.36", "81.177.215.15", "89.106.83.49", "157.173.29.133")
$netstat = netstat -ano | Select-String -Pattern "TCP|UDP"
foreach ($ip in $auroraIPs) {
    if ($netstat -match $ip) {
        Write-Host "[!] CRITICAL: Connection to Aurora C2 IP $ip detected!" -ForegroundColor Red
        Get-NetTCPConnection | Where-Object {$_.RemoteAddress -eq $ip} | Format-Table
    }
}

# 3. Check for PHP2Shell artifacts (Web server directories)
Write-Host "`n[*] Scanning common web directories for PHP web shells..." -ForegroundColor Yellow
$webDirs = @("C:\inetpub\wwwroot", "C:\xampp\htdocs", "C:\wamp\www")
$phpShellPatterns = @("eval(", "base64_decode", "shell_exec", "system(", "passthru", "cmd.exe")

foreach ($dir in $webDirs) {
    if (Test-Path $dir) {
        $phpFiles = Get-ChildItem -Path $dir -Recurse -Filter "*.php" -ErrorAction SilentlyContinue | Select-Object -First 1000
        foreach ($file in $phpFiles) {
            try {
                $content = Get-Content $file.FullName -Raw -ErrorAction SilentlyContinue
                foreach ($pattern in $phpShellPatterns) {
                    if ($content -match $pattern -and $file.Length -lt 50KB) {
                        Write-Host "[!] Suspicious PHP file detected: $($file.FullName)" -ForegroundColor Red
                        break
                    }
                }
            } catch {}
        }
    }
}

# 4. Check running processes for suspicious command lines
Write-Host "`n[*] Checking for suspicious process command lines..." -ForegroundColor Yellow
$suspiciousProcesses = Get-CimInstance Win32_Process | Where-Object {
    $_.CommandLine -match "vim-cmd|esxcli|chacha20|rsa-4096" -or
    $_.CommandLine -match "powershell.*-enc|powershell.*-e " -or
    $_.Name -match "php.*-r|php.*-f"
}

if ($suspiciousProcesses) {
    Write-Host "[!] Suspicious processes detected:" -ForegroundColor Red
    $suspiciousProcesses | Select-Object ProcessId, Name, CommandLine | Format-Table -AutoSize
} else {
    Write-Host "[+] No suspicious processes found." -ForegroundColor Green
}

# 5. ESXi-specific checks (if running on ESXi host or via SSH)
if ($CheckESXi) {
    Write-Host "`n[*] ESXi-specific checks (requires SSH/ESXi Shell)..." -ForegroundColor Yellow
    Write-Host "    Manual commands to run on ESXi hosts:" -ForegroundColor Cyan
    Write-Host "    - Check for unauthorized SSH keys: cat /etc/ssh/keys-root/authorized_keys" -ForegroundColor Gray
    Write-Host "    - Check for suspicious cron jobs: crontab -l" -ForegroundColor Gray
    Write-Host "    - Check for running processes: esxcli system process list | grep -E 'aurora|roarur|enc'" -ForegroundColor Gray
    Write-Host "    - Check VM power states: vim-cmd vmsvc/getallvms" -ForegroundColor Gray
}

# 6. Hash verification for known bad files
Write-Host "`n[*] Checking for known malicious file hashes in common locations..." -ForegroundColor Yellow
$checkPaths = @("$env:TEMP", "$env:APPDATA", "C:\ProgramData", "C:\Users\Public")
foreach ($path in $checkPaths) {
    if (Test-Path $path) {
        $files = Get-ChildItem -Path $path -Recurse -File -ErrorAction SilentlyContinue | Select-Object -First 500
        foreach ($file in $files) {
            try {
                $hash = Get-FileHash -Path $file.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue
                if ($maliciousHashes.ContainsKey($hash.Hash)) {
                    Write-Host "[!] MALWARE DETECTED: $($file.FullName) — $($maliciousHashes[$hash.Hash])" -ForegroundColor Red
                }
            } catch {}
        }
    }
}

Write-Host "`n[$timestamp] Threat hunt complete. Review any [!] findings immediately." -ForegroundColor Cyan

Response Priorities

Immediate (0-24 Hours)

• Block IOCs: Immediately implement deny rules for all IPv4 indicators (146.19.125.36, 81.177.215.15, 89.106.83.49, 157.173.29.133, 96.126.130.81, 103.245.231.248) at network perimeter and DNS filtering for domains (preentootmist.org, captchanom.top).
• Isolate Virtual Infrastructure: If Aurora IOCs are detected, immediately isolate ESXi hosts from the network. Power down VMs gracefully if possible (to preserve forensic data), but prioritize containment over availability.
• Hunt for Execution: Deploy the KQL queries and PowerShell script above across all Windows endpoints and ESXi management interfaces. Search for ChaCha20 artifacts, unexpected VM power-offs, or SSH key additions to ESXi hosts.
• Credential Reset: If Star Blizzard phishing is suspected, force password resets for all targeted users and revoke active sessions (especially Microsoft 365 and Google Workspace tokens), as EvilGinx captures session cookies bypassing MFA.

24 Hours

• Identity Verification: For organizations targeted by Star Blizzard, implement out-of-band verification for any unusual email requests, particularly those involving financial transactions or credential resets. Review OAuth application consents for suspicious third-party apps.
• Vulnerability Assessment: Scan for CVE-2022-30190, CVE-2023-36884, CVE-2024-4947, CVE-2026-109618, and CVE-2026-109619 across the estate. Prioritize patching internet-facing systems and ESXi hosts.
• Web Shell Sweep: For environments with PHP applications (particularly Japanese real estate or financial services), conduct comprehensive file integrity monitoring sweeps for web shell artifacts.

1 Week

• Architecture Hardening — ESXi: Enable VMware ESXi Lockdown Mode to restrict direct host access. Implement vSphere Trust Authority for hardware-based attestation. Disable ESXi Shell and SSH when not required for maintenance. Segment vCenter and ESXi management interfaces onto isolated VLANs unreachable from general user networks.
• Email Security Enhancement: Deploy DMARC/DKIM/SPF enforcement to reduce Star Blizzard phishing success. Implement URL rewriting and attachment sandboxing to detect EvilGinx proxy attempts and Follina (CVE-2022-30190) exploit documents.
• AI Tool Governance: Establish acceptable use policies for AI-powered development tools (Cursor, GitHub Copilot, etc.) to prevent abuse by threat actors or accidental exposure of internal infrastructure details to external AI APIs.
• Backup Validation: Verify offline backups of critical virtual infrastructure. Aurora specifically targets virtualization layers to destroy recovery options — ensure ESXi host configurations and VM backups are immutable and physically segregated.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub