BINDCLOAK Modular Backdoor + MIXEDKEY Loader: OTX Pulse Analysis — Middle East Government Campaign Detection Pack

---
title: BINDCLOAK C2 Infrastructure Resolution or Connection
id: 9f3e1a2b-7c4d-4e8a-b6f1-2d5c8a9e0b11
status: experimental
description: Detects DNS resolution of known BINDCLOAK / MIXEDKEY campaign C2 domains and subdomains used in the Middle East government targeting campaign (Zscaler-documented).
author: Security Arsenal Threat Intel
logsource:
    category: dns
    service: dns
detection:
    selection:
        query|contains:
            - 'ftabnews.com'
            - 'hypersnet.com'
            - 'blsouqs.com'
    condition: selection
falsepositives:
    - Threat intel sandbox detonation
    - Security research activity
level: critical
tags:
    - attack.command_and_control
    - attack.t1071
date: 2026/08/06
---
title: MIXEDKEY Loader Known File Hash Execution
id: 8d2f0b1a-6b3c-4d7a-a5e0-1c4b7d8e9f22
status: experimental
description: Detects execution of files matching known MIXEDKEY loader / BINDCLOAK staging artifact hashes observed in the targeted Middle East government campaign.
author: Security Arsenal Threat Intel
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Hashes|contains:
            - '7a14a99d70d42d3f7bf72f843185fc07'
            - '577b1cc894636f4ac5ad670b0079b9b7ade137c3'
            - '3b0c658ebaa2bae80af97f390b9b2bb20a2f815eb584b2251255e84da4fa669d'
    condition: selection
falsepositives:
    - Malware research environments
level: critical
tags:
    - attack.execution
    - attack.defense_evasion
    - attack.t1620
date: 2026/08/06
---
title: Reflective DLL Loading Indicators - BINDCLOAK In-Memory Execution
id: 7c1e9a0b-5a2b-3c6d-9b4f-0b3a6c7d8e33
status: experimental
description: Detects behaviors consistent with reflective in-memory loading used by MIXEDKEY to deploy BINDCLOAK — unsigned process memory allocation with RWX permissions and module loads from non-standard paths.
author: Security Arsenal Threat Intel
logsource:
    category: image_load
    product: windows
detection:
    selection_unsigned:
        Signed: 'false'
    selection_suspicious_path:
        ImageLoaded|contains:
            - '\AppData\Local\Temp\'
            - '\AppData\Roaming\'
            - '\ProgramData\'
            - '\Users\Public\'
    filter_system:
        ImageLoaded|startswith:
            - 'C:\Windows\System32\'
            - 'C:\Windows\SysWOW64\'
            - 'C:\Program Files\'
            - 'C:\Program Files (x86)\'
    condition: selection_unsigned and selection_suspicious_path and not filter_system
falsepositives:
    - Legitimate unsigned LOB application plugins
    - Developer tooling loading unsigned libraries
level: high
tags:
    - attack.defense_evasion
    - attack.t1620
    - attack.privilege_escalation
    - attack.t1055
date: 2026/08/06

// BINDCLOAK / MIXEDKEY Campaign Hunt — C2 connections, loader hashes, and suspicious unsigned module loads
// Recommended lookback: 90 days (espionage dwell time)
let C2Domains = dynamic(["ftabnews.com", "hypersnet.com", "blsouqs.com",
    "contacts.ftabnews.com", "cert.hypersnet.com", "ssl.blsouqs.com", "about.blsouqs.com"]);
let LoaderHashes = dynamic(["7a14a99d70d42d3f7bf72f843185fc07",
    "577b1cc894636f4ac5ad670b0079b9b7ade137c3",
    "3b0c658ebaa2bae80af97f390b9b2bb20a2f815eb584b2251255e84da4fa669d"]);
let NetworkHits = DeviceNetworkEvents
    | where TimeGenerated > ago(90d)
    | where RemoteUrl has_any (C2Domains)
    | project NetworkHit=TimeGenerated, DeviceName, RemoteUrl, RemoteIP, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessSHA256;
let ProcessHits = DeviceProcessEvents
    | where TimeGenerated > ago(90d)
    | where MD5 in~ (LoaderHashes) or SHA1 in~ (LoaderHashes) or SHA256 in~ (LoaderHashes)
    | project ProcessHit=TimeGenerated, DeviceName, FileName, FolderPath, ProcessCommandLine, SHA256, InitiatingProcessFileName;
let ReflectiveLoadHits = DeviceImageLoadEvents
    | where TimeGenerated > ago(30d)
    | where FolderPath has_any ("\\AppData\\Local\\Temp\\", "\\Users\\Public\\", "\\ProgramData\\")
    | where FileName endswith ".dll"
    | project ModuleLoad=TimeGenerated, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName;
union NetworkHits, ProcessHits, ReflectiveLoadHits
| order by DeviceName asc

<#
.SYNOPSIS
    BINDCLOAK / MIXEDKEY campaign host triage script
.DESCRIPTION
    Checks a Windows host for IOCs associated with the Middle East government campaign:
    DNS cache hits, active connections to C2, loader file hashes, and persistence artifacts.
.NOTES
    Run elevated. Deploy via RMM/Intune/SCCM across the fleet for sweep-style hunting.
#>

$C2Domains  = @('ftabnews.com','hypersnet.com','blsouqs.com','contacts.ftabnews.com',
                'cert.hypersnet.com','ssl.blsouqs.com','about.blsouqs.com')
$LoaderHash = '3b0c658ebaa2bae80af97f390b9b2bb20a2f815eb584b2251255e84da4fa669d'
$Findings   = @()

Write-Host "[*] Checking DNS resolver cache for C2 domains..." -ForegroundColor Cyan
Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object {
    $d = $_.Entry; $C2Domains | Where-Object { $d -like "*$_*" }
} | ForEach-Object { $Findings += "[DNS] Cache entry: $($_.Entry) -> $($_.Data)" }

Write-Host "[*] Checking active network connections against C2 hostnames..." -ForegroundColor Cyan
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | ForEach-Object {
    try {
        $r = Resolve-DnsName -Name $_.RemoteAddress -ErrorAction Stop -DnsOnly
        if ($C2Domains | Where-Object { $r.NameHost -like "*$_*" }) {
            $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
            $Findings += "[NET] Connection to $($r.NameHost) ($($_.RemoteAddress)) by PID $($_.OwningProcess) [$($proc.ProcessName)]"
        }
    } catch {}
}

Write-Host "[*] Sweeping common staging paths for loader hash..." -ForegroundColor Cyan
$Paths = @("$env:TEMP", "$env:APPDATA", "$env:LOCALAPPDATA", "C:\ProgramData", "C:\Users\Public")
foreach ($p in $Paths) {
    Get-ChildItem -Path $p -Recurse -File -ErrorAction SilentlyContinue -Include *.exe,*.dll,*.dat,*.bin |
        Select-Object -First 5000 | ForEach-Object {
            try {
                $h = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction Stop).Hash
                if ($h -eq $LoaderHash) { $Findings += "[HASH] Loader match: $($_.FullName)" }
            } catch {}
        }
}

Write-Host "[*] Auditing persistence mechanisms (Run keys, scheduled tasks)..." -ForegroundColor Cyan
$RunKeys = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
             'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
             'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run')
foreach ($k in $RunKeys) {
    if (Test-Path $k) {
        Get-ItemProperty $k | ForEach-Object {
            $_.PSObject.Properties | Where-Object { $_.Name -notmatch '^PS' } | ForEach-Object {
                if ($_.Value -match 'Temp|AppData|Public|ProgramData') {
                    $Findings += "[PERSIST] Suspicious Run key: $k\$($_.Name) = $($_.Value)"
                }
            }
        }
    }
}
Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object {
    $_.Actions.Execute -match 'Temp|AppData|Users\\Public' -and
    $_.Author -notmatch 'Microsoft'
} | ForEach-Object { $Findings += "[PERSIST] Suspicious task: $($_.TaskName) -> $($_.Actions.Execute)" }

Write-Host "`n========== RESULTS ==========" -ForegroundColor Yellow
if ($Findings.Count -eq 0) { Write-Host "[+] No BINDCLOAK/MIXEDKEY indicators found on this host." -ForegroundColor Green }
else {
    $Findings | ForEach-Object { Write-Host $_ -ForegroundColor Red }
    $Findings | Out-File "$env:TEMP\bindcloak_triage_$(Get-Date -Format 'yyyyMMdd_HHmmss').log"
    Write-Host "`n[!] $($Findings.Count) finding(s). Log saved. ISOLATE HOST AND ESCALATE." -ForegroundColor Red
}