Black October Campaign: AI Platform Credential Theft & LLMjacking — OTX Detection Engineering Pack

---
title: AI Platform Credential Theft - Environment Variable Access
id: 8a7b3c9d-2e4f-4a1b-9c8d-3f5e6a7b8c9d
status: experimental
description: Detects suspicious enumeration of environment variables commonly targeted in AI platform breaches
author: Security Arsenal Threat Intelligence
date: 2026/11/04
references:
    - https://otx.alienvault.com/pulse/ Black October for AI Developer Platforms
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains:
            - 'env | grep -i key'
            - 'env | grep -i secret'
            - 'env | grep -i token'
            - 'printenv | grep -i api'
            - 'Get-ChildItem Env:'
            - 'gci env:'
            - 'ls env:'
            - '[Environment]::GetEnvironmentVariables'
    condition: selection
falsepositives:
    - Legitimate system administration
    - Developer debugging activities
level: medium
tags:
    - attack.credential_access
    - attack.t1552.001
---
title: LLMjacking C2 Communication - Known Bad Infrastructure
id: 9b8c4d5e-3f5a-4b2c-0d9e-4a6f7b8c9d0e
status: experimental
description: Detects network connections to infrastructure associated with Black October AI platform breaches
author: Security Arsenal Threat Intelligence
date: 2026/11/04
references:
    - https://otx.alienvault.com/pulse/ Black October for AI Developer Platforms
logsource:
    category: network_connection
    product: windows
detection:
    selection_ip:
        DestinationIp:
            - '31.57.201.201'
            - '38.246.114.118'
    selection_dns:
        DestinationHostname:
            - 'artex.nhhh.de'
            - 'direct.465415.xyz'
    condition: selection_ip or selection_dns
falsepositives:
    - Unlikely - these are high-confidence malicious indicators
level: high
tags:
    - attack.command_and_control
    - attack.t1071.001
---
title: Suspicious AI Platform Config File Access
id: 0c9d5e6f-4a6b-4c3d-1e0f-5b7c8d9e0f1a
status: experimental
description: Detects mass access to configuration files containing AI service credentials
author: Security Arsenal Threat Intelligence
date: 2026/11/04
references:
    - https://otx.alienvault.com/pulse/ Black October for AI Developer Platforms
logsource:
    category: file_access
    product: windows
detection:
    selection:
        TargetFilename|contains:
            - '.env'
            - 'config.json'
            - 'credentials.json'
            - 'appsettings.json'
    filter_user:
        SubjectUserName|contains:
            - 'SYSTEM'
            - 'NETWORK SERVICE'
    condition: selection and not filter_user
falsepositives:
    - Legitimate application deployment
    - Configuration management tools
level: medium
tags:
    - attack.credential_access
    - attack.t1552.001

// Black October Campaign - AI Platform Credential Theft Hunt
// Detects network connections to known C2 and suspicious process patterns

let C2_IPs = dynamic(["31.57.201.201", "38.246.114.118"]);
let C2_Domains = dynamic(["artex.nhhh.de", "direct.465415.xyz"]);

union isfuzzy=true
    (DeviceNetworkEvents
    | where TimeGenerated > ago(90d)
    | where RemoteIP in (C2_IPs) or RemoteUrl in (C2_Domains)
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort
    | extend AlertType = "Network Connection to C2"),
    (DeviceProcessEvents
    | where TimeGenerated > ago(30d)
    | where ProcessCommandLine has_any ("env | grep", "printenv", "Get-ChildItem Env", "[Environment]::GetEnvironmentVariables")
    | where ProcessCommandLine has_any ("key", "secret", "token", "api", "password")
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, AccountName
    | extend AlertType = "Suspicious Environment Enumeration"),
    (DeviceFileEvents
    | where TimeGenerated > ago(30d)
    | where FileName has_any (".env", "credentials.json", "config.json")
    | where FolderPath has_any ("app", "config", "deploy", "workspace")
    | project TimeGenerated, DeviceName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine
    | extend AlertType = "Credential File Access")
| sort by TimeGenerated desc

# Black October Campaign - IOC Hunt Script
# Run on endpoints and servers to check for compromise indicators

Write-Host "=== Black October AI Platform Breach IOC Hunt ===" -ForegroundColor Cyan
Write-Host "Checking for indicators from OTX Pulse: Black October for AI Developer Platforms`n" -ForegroundColor Yellow

$ErrorActionPreference = "SilentlyContinue"

# Check network connections to known C2
Write-Host "[*] Checking active network connections to known C2 infrastructure..." -ForegroundColor Green
$C2_IPs = @("31.57.201.201", "38.246.114.118")
$C2_Domains = @("artex.nhhh.de", "direct.465415.xyz")

$connections = Get-NetTCPConnection | Where-Object { $_.RemoteAddress -in $C2_IPs }
if ($connections) {
    Write-Host "[!] ALERT: Active connections to malicious IPs detected!" -ForegroundColor Red
    $connections | Format-Table LocalAddress, LocalPort, RemoteAddress, RemotePort, State, OwningProcess
    $connections | ForEach-Object {
        $proc = Get-Process -Id $_.OwningProcess
        Write-Host "    Process: $($proc.ProcessName) (PID: $($proc.Id)) - Path: $($proc.Path)" -ForegroundColor Red
    }
} else {
    Write-Host "[+] No active connections to known C2 IPs" -ForegroundColor Green
}

# Check DNS cache for malicious domains
Write-Host "`n[*] Checking DNS cache for malicious domains..." -ForegroundColor Green
$dnsCache = Get-DnsClientCache | Where-Object { $_.Entry -in $C2_Domains -or $_.Name -in $C2_Domains }
if ($dnsCache) {
    Write-Host "[!] ALERT: Malicious domains found in DNS cache!" -ForegroundColor Red
    $dnsCache | Format-Table Entry, Name, Data, TimeToLive
} else {
    Write-Host "[+] No malicious domains in DNS cache" -ForegroundColor Green
}

# Check for suspicious environment variable access patterns in PowerShell history
Write-Host "`n[*] Checking PowerShell history for suspicious environment enumeration..." -ForegroundColor Green
$psHistory = Get-Content (Get-PSReadlineOption).HistorySavePath -ErrorAction SilentlyContinue | Select-String -Pattern "Get-ChildItem Env|gci env|ls env|Environment.*GetEnvironmentVariables" | Select-Object -Last 20
if ($psHistory) {
    Write-Host "[!] Suspicious environment access patterns in PowerShell history:" -ForegroundColor Yellow
    $psHistory | ForEach-Object { Write-Host "    $_" -ForegroundColor Yellow }
} else {
    Write-Host "[+] No suspicious patterns in PowerShell history" -ForegroundColor Green
}

# Check for credential files in common deployment directories
Write-Host "`n[*] Checking for exposed credential files..." -ForegroundColor Green
$deployPaths = @("C:\deploy", "C:\app", "C:\workspace", "C:\inetpub", "C:\home")
$credFiles = @("*.env", "credentials.json", "config.json", "appsettings*.json")

foreach ($path in $deployPaths) {
    if (Test-Path $path) {
        $found = Get-ChildItem -Path $path -Recurse -Include $credFiles -ErrorAction SilentlyContinue | Select-Object -First 10
        if ($found) {
            Write-Host "[!] Credential files found in $path :" -ForegroundColor Yellow
            $found | ForEach-Object { Write-Host "    $($_.FullName)" -ForegroundColor Yellow }
        }
    }
}

# Check scheduled tasks for persistence
Write-Host "`n[*] Checking scheduled tasks for suspicious entries..." -ForegroundColor Green
$tasks = Get-ScheduledTask | Where-Object { $_.TaskName -match "update|sync|check" -and $_.TaskPath -notlike "*Microsoft*" } | Select-Object -First 10
if ($tasks) {
    Write-Host "[*] Non-Microsoft scheduled tasks (review for anomalies):" -ForegroundColor Cyan
    $tasks | Format-Table TaskName, TaskPath, State
}

Write-Host "`n=== Hunt Complete ===" -ForegroundColor Cyan
Write-Host "If any alerts triggered, isolate the host and initiate credential rotation immediately." -ForegroundColor Yellow