BambooToken MQTT C2, PeckBirdy Scambling Infrastructure & Fake MP4 NetSupport RAT: OTX Pulse Analysis — Enterprise Detection Pack

---
title: BambooToken MQTT Command and Control to Known Broker Infrastructure
id: 7f2a1c4e-9b3d-4e5f-a1c2-b8d9e0f1a2b3
status: experimental
description: Detects outbound MQTT connections (ports 1883/8883) to known BambooToken broker domains associated with PlugX/Korplug infection brokering across Asia and South America.
references:
    - https://www.lumen.com/blog/en-us/the-banana-stand-brokering-and-managing-infections-across-asia-using-mqtt
author: Security Arsenal Threat Intelligence
date: 2026/10/16
tags:
    - attack.command_and_control
    - attack.t1071
    - attack.t1102
logsource:
    category: network_connection
    product: windows
detection:
    selection_port:
        DestinationPort:
            - 1883
            - 8883
    selection_domain:
        DestinationHostname|contains:
            - 'c2iznja.com'
            - 'chat5188.tk'
    filter_legit_brokers:
        DestinationHostname|contains:
            - 'amazonaws.com'  # tune to your approved IoT brokers
            - 'azure-devices.net'
    condition: selection_port and selection_domain and not filter_legit_brokers
falsepositives:
    - Legitimate IoT telemetry to sanctioned MQTT brokers — maintain an allowlist of approved broker FQDNs
level: high
---
title: DLL Sideloading via Signed Tendyron OnKey or Legitimate Banking Token Binary
id: 8a3b2d5f-0c4e-5f6a-b2d3-c9e0f1a2b3c4
status: experimental
description: Detects DLL load events where a signed legitimate executable loads an unsigned or oddly-located DLL — consistent with PlugX/Korplug/BambooToken sideloading tradecraft including Tendyron OnKey abuse.
references:
    - https://www.lumen.com/blog/en-us/the-banana-stand-brokering-and-managing-infections-across-asia-using-mqtt
author: Security Arsenal Threat Intelligence
date: 2026/10/16
tags:
    - attack.defense_evasion
    - attack.persistence
    - attack.t1574.002
logsource:
    category: image_load
    product: windows
detection:
    selection_unsigned:
        Signed: 'false'
    selection_path:
        ImageLoaded|contains:
            - '\AppData\'
            - '\ProgramData\'
            - '\Users\Public\'
            - '\Temp\'
    selection_parent_signed:
        Signed: 'true'
    condition: selection_unsigned and selection_path
falsepositives:
    - Legitimate vendor updaters loading unsigned components — baseline by Image name
level: medium
---
title: Fake MP4 Container Retrieval Followed by PowerShell Execution — NetSupport RAT Chain
id: 9b4c3e6a-1d5f-6a7b-c3e4-d0f1a2b3c4d5
status: experimental
description: Detects PowerShell invoking web requests for .mp4 resources from known NetSupport delivery infrastructure or writing MP4 files to user-writable staging directories, per the Censys fake-MP4 NetSupport chain.
references:
    - https://censys.com/blog/fake-mp4-file-carries-malicious-payload/
author: Security Arsenal Threat Intelligence
date: 2026/10/16
tags:
    - attack.execution
    - attack.t1059.001
    - attack.t1105
    - attack.t1036
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
    selection_cli_download:
        CommandLine|contains:
            - 'Invoke-WebRequest'
            - 'Invoke-RestMethod'
            - 'DownloadFile'
            - 'DownloadString'
            - 'Start-BitsTransfer'
            - 'curl.exe'
    selection_cli_mp4:
        CommandLine|contains:
            - '.mp4'
            - 'approvalrequest-api.com'
            - 'usersecuritycheck.com'
            - 'karlenagida.com'
            - 'x2664.com'
            - '89.34.90.111'
    condition: selection_img and selection_cli_download and selection_cli_mp4
falsepositives:
    - Rare — legitimate scripted video downloads; validate destination domain against allowlist
level: critical

// Security Arsenal — OTX Pulse Hunt: BambooToken MQTT C2 + Fake MP4 NetSupport Chain
// Covers: MQTT egress to broker domains, NetSupport delivery domains, .mp4 payload retrieval, sideloading staging
let Lookback = 7d;
let BambooTokenC2 = dynamic(["c2iznja.com","chat5188.tk","api80.c2iznja.com","base64.c2iznja.com","live-hk.c2iznja.com","newdma.c2iznja.com","turbo.c2iznja.com","api06.chat5188.tk","api08.chat5188.tk"]);
let NetSupportDelivery = dynamic(["x2664.com","usersecuritycheck.com","approvalrequest-api.com","karlenagida.com","89.34.90.111"]);
let ScamblingInfra = dynamic(["zzyud.com","11168833.com","11170011.com","1862.cc","312zym001.cc","80074.cc","843470.cc","am125.cc"]);
union isfuzzy=true
    (DeviceNetworkEvents
    | where TimeGenerated > ago(Lookback)
    | where RemoteUrl has_any (BambooTokenC2) or RemoteUrl has_any (NetSupportDelivery) or RemoteUrl has_any (ScamblingInfra)
    | extend Detection = "IOC Domain Resolution/Connection"
    | project TimeGenerated, Detection, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort),
    (DeviceNetworkEvents
    | where TimeGenerated > ago(Lookback)
    | where RemotePort in (1883, 8883)
    | where InitiatingProcessFileName !in~ ("mosquitto.exe","node.exe")  // tune approved MQTT clients
    | extend Detection = "MQTT Egress — Non-Standard Process"
    | project TimeGenerated, Detection, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort),
    (DeviceNetworkEvents
    | where TimeGenerated > ago(Lookback)
    | where RemoteUrl endswith ".mp4" or RemoteIP == "89.34.90.111"
    | where InitiatingProcessFileName in~ ("powershell.exe","pwsh.exe","cmd.exe","curl.exe","bitsadmin.exe")
    | extend Detection = "Script-Process MP4 Retrieval (Fake MP4 Loader)"
    | project TimeGenerated, Detection, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort),
    (DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where FileName in~ ("powershell.exe","pwsh.exe")
    | where ProcessCommandLine has_any ("DownloadFile","Invoke-WebRequest","Invoke-RestMethod","Start-BitsTransfer") and ProcessCommandLine has ".mp4"
    | extend Detection = "PowerShell MP4 Download (NetSupport Chain)"
    | project TimeGenerated, Detection, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessAccountName)
| order by TimeGenerated desc

# Security Arsenal — OTX IOC Hunt Script (BambooToken / PlugX / NetSupport)
# Run elevated on suspect endpoints or deploy fleet-wide via your EDR/SCCM.
# Checks: DNS cache for C2, MQTT connections, fake MP4 staging, persistence artifacts.

$ErrorActionPreference = 'SilentlyContinue'
$report = @()

$bambooC2   = @('c2iznja.com','chat5188.tk')
$netSupport = @('x2664.com','usersecuritycheck.com','approvalrequest-api.com','karlenagida.com')
$scambling  = @('zzyud.com','11168833.com','11170011.com','1862.cc','312zym001.cc','80074.cc','843470.cc','am125.cc')
$allDomains = $bambooC2 + $netSupport + $scambling

Write-Host '[*] Checking DNS cache for C2 / delivery domains...' -ForegroundColor Cyan
$dnsCache = Get-DnsClientCache | Where-Object { $e = $_.Entry; $allDomains | Where-Object { $e -like "*$_*" } }
if ($dnsCache) { $dnsCache | ForEach-Object { $report += [pscustomobject]@{Check='DNS Cache'; Finding=$_.Entry; Data=$_.Data} } }

Write-Host '[*] Checking active MQTT (1883/8883) connections...' -ForegroundColor Cyan
$mqtt = Get-NetTCPConnection | Where-Object { $_.RemotePort -in 1883,8883 -and $_.State -eq 'Established' }
foreach ($c in $mqtt) {
    $proc = Get-Process -Id $c.OwningProcess
    $report += [pscustomobject]@{Check='MQTT Connection'; Finding="$($proc.ProcessName) -> $($c.RemoteAddress):$($c.RemotePort)"; Data=$proc.Path}
}

Write-Host '[*] Checking connections to NetSupport delivery IP...' -ForegroundColor Cyan
$ns = Get-NetTCPConnection | Where-Object { $_.RemoteAddress -eq '89.34.90.111' }
foreach ($c in $ns) {
    $proc = Get-Process -Id $c.OwningProcess
    $report += [pscustomobject]@{Check='NetSupport C2 IP'; Finding="$($proc.ProcessName) -> 89.34.90.111:$($c.RemotePort)"; Data=$proc.Path}
}

Write-Host '[*] Hunting staged fake MP4 payloads (>1MB in user-writable paths)...' -ForegroundColor Cyan
$paths = @("$env:PUBLIC","$env:TEMP","$env:APPDATA","$env:LOCALAPPDATA","$env:ProgramData")
foreach ($p in $paths) {
    Get-ChildItem -Path $p -Recurse -Include *.mp4 -ErrorAction SilentlyContinue |
        Where-Object { $_.Length -gt 1MB } |
        ForEach-Object { $report += [pscustomobject]@{Check='Fake MP4 Staging'; Finding=$_.FullName; Data="$([math]::Round($_.Length/1MB,2)) MB"} }
}

Write-Host '[*] Checking NetSupport client artifacts (client32.exe)...' -ForegroundColor Cyan
@("$env:ProgramFiles\NetSupport","${env:ProgramFiles(x86)}\NetSupport","$env:APPDATA\NetSupport","$env:ProgramData\NetSupport") |
    ForEach-Object { if (Test-Path $_) { $report += [pscustomobject]@{Check='NetSupport Install Dir'; Finding=$_; Data='Investigate client32.exe / client32.ini'} } }
Get-Process -Name client32 | ForEach-Object { $report += [pscustomobject]@{Check='NetSupport Running'; Finding='client32.exe'; Data=$_.Path} }

Write-Host '[*] Checking persistence (Run keys, services, scheduled tasks) for PlugX/sideload artifacts...' -ForegroundColor Cyan
$runKeys = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
             'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run',
             'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run')
foreach ($rk in $runKeys) {
    Get-ItemProperty -Path $rk | ForEach-Object {
        $_.PSObject.Properties | Where-Object { $_.Value -match 'AppData|ProgramData|Temp|client32|rundll32.*dll' } |
            ForEach-Object { $report += [pscustomobject]@{Check='Run Key Persistence'; Finding="$rk\$($_.Name)"; Data=$_.Value} }
    }
}
Get-ScheduledTask | Where-Object { $_.Actions.Execute -match 'powershell|client32|rundll32' -and $_.TaskPath -notlike '\Microsoft\*' } |
    ForEach-Object { $report += [pscustomobject]@{Check='Scheduled Task'; Finding=$_.TaskName; Data=$_.Actions.Execute} }

Write-Host "`n[+] Hunt complete. $($report.Count) findings." -ForegroundColor Green
$report | Format-Table -AutoSize
$report | Export-Csv -Path "$env:TEMP\otx_hunt_$(Get-Date -Format yyyyMMdd_HHmm).csv" -NoTypeInformation