BlueMoon Chrome/Windows 0-Day Chain, ClearFake WebDAV Infection & Virtualized Vidar Stealer: OTX Pulse Analysis — Enterprise Detection Pack

Three concurrent OTX pulses paint a coherent picture of a threat landscape dominated by two converging trends: state-aligned espionage actors rapidly weaponizing novel browser/OS exploit chains, and crimeware-grade infostealers achieving nation-state-level evasion maturity.

The most strategically significant pulse documents the BlueMoon exploit kit, which chains a Chromium V8 type-confusion vulnerability (CVE-2026-85046), a V8 sandbox escape, and a Microsoft Windows elevation-of-privilege flaw (CVE-2026-85880) to achieve full system compromise from a single web visit. China-aligned TA412 (APT31) adopted the chain first on 28 August 2026, with at least three additional suspected China-nexus espionage groups adopting it within days — a pattern consistent with shared exploit tooling proliferating across MSS-affiliated clusters. Payloads delivered include the new BlueMoon implant, GemStone, and the well-documented ShadowPad backdoor (including the POISONPLUG.SHADOW loader). Targeting spans aerospace, government, NGO, manufacturing, and finance verticals — classic strategic espionage collection requirements.

In parallel, the ClearFake cluster (tracked by Cisco Talos as UAT-10820) has evolved its fake-browser-update/fake-CAPTCHA social engineering to a WebDAV-based DLL execution chain leveraging EtherHiding — JavaScript payloads stored immutably on the BNB Smart Chain blockchain, injected via Cloudflare Workers. The operation delivers Amatera stealer as its primary payload, with ZigCryptoStealer and a trojanized NetSupport Manager RAT as secondary payloads, targeting cryptocurrency assets and credentials across the US, Brazil, India, Indonesia, Ukraine, Egypt, and government sectors.

The third pulse dissects a Vidar infostealer variant implementing a custom virtual machine for code obfuscation — proprietary bytecode interpretation defeats static analysis, while NtQueryInformationProcess debugger checks and RDTSC timing loops defeat dynamic analysis. Vidar continues to exfiltrate browser credentials, Azure tokens, and session data via Telegram-based C2.

Collectively: defenders face drive-by 0-day compromise from state actors, blockchain-anchored crimeware infrastructure that cannot be taken down, and infostealers engineered to blind sandbox-based detection.

Threat Actor / Malware Profile

BlueMoon Exploit Kit (TA412 / APT31 and 3+ China-nexus clusters)

• Distribution: Drive-by web exploitation; decoy delivery infrastructure impersonating Microsoft services (e.g., msbenefit.com) and CDN domains (attcdn.com).
• Payload behavior: Multi-stage exploit chain — V8 type-confusion for renderer RCE → V8 sandbox escape → CVE-2026-85880 Windows privilege escalation → deployment of BlueMoon/GemStone implants or ShadowPad backdoor with POISONPLUG.SHADOW loader.
• Persistence: ShadowPad family typically persists via service installation, DLL side-loading against legitimate signed binaries, and scheduled tasks.
• C2: Historically domain-fronted HTTPS C2 with legitimate-looking hostnames; monitor for beaconing to the 82 indicators in this pulse.
• Objective: Long-dwell espionage against aerospace, government, NGO, manufacturing, and finance.

ClearFake / UAT-10820 — Amatera, ZigCryptoStealer, NetSupport Manager

• Distribution: Compromised websites + Cloudflare Workers injecting JavaScript retrieved from BNB Smart Chain contracts (EtherHiding), rendering fake Google CAPTCHA/ClickFix-style prompts that coerce users into executing commands reaching a WebDAV share, which loads a malicious DLL (pf.ch).
• Payload behavior: Amatera stealer harvests browser credentials, cookies, and crypto wallets; ZigCryptoStealer targets wallet extensions specifically; trojanized NetSupport Manager provides full remote access as a fallback/parallel payload.
• C2: WebDAV (TCP 80/443) for staging; stealer exfiltration over HTTPS; blockchain-RPC traffic to BSC nodes is a behavioral tell.
• Anti-analysis: EtherHiding makes C2/payload storage uncensorable; ClickFix lures evade email/web gateways because the victim executes the payload manually via Run dialog.

Vidar (Virtualized Variant)

• Distribution: Malvertising, cracked software, fake installers.
• Anti-analysis: Custom VM bytecode virtualization, debugger detection via NtQueryInformationProcess (ProcessDebugPort/ProcessDebugFlags), RDTSC timing checks, AV process enumeration, and system resource checks for sandbox detection.
• Payload behavior: Browser credential/cookie theft, Azure token theft, Telegram-based C2 and exfiltration.
• Persistence: Typically run-once with scheduled task or Run-key fallback; check %AppData% and %ProgramData% staging directories.

IOC Analysis

The pulses contain four indicator classes requiring distinct operationalization:

• File hashes (MD5/SHA1/SHA256): 9 Vidar hashes, plus BlueMoon and ClearFake payload hashes. Push SHA256 values into EDR blocklists (Defender, CrowdStrike custom IOA, SentinelOne blacklist) and retro-hunt via EDR telemetry for any historical execution. MD5/SHA1 should only be used for retro-hunting, never as primary blocking keys.
• Domains/hostnames: msbenefit.com, attcdn.com, leaguejazire.com, smart.hugo-mapp.co, paf.hugo-mapp.co (note: verification.google is a deceptive subdomain-style indicator — block at DNS and inspect for typosquat patterns). Sinkhole or block at the DNS resolver (RPZ), web proxy, and firewall.
• IP addresses: 45.150.34.2 — block at perimeter, and query NetFlow/proxy logs for 90 days of historical contact.
• CVEs (CVE-2026-85046, CVE-2026-85880): Not traditional IOCs — these drive emergency patch management for Chrome/Chromium-based browsers and Windows. Until patched, virtual patching via network-level exploit detection and browser isolation is the compensating control.

Tooling: Hashes → EDR/VirusTotal Intelligence; domains/IPs → DNS firewall, proxy, SIEM watchlists; blockchain-RPC traffic → NetFlow/Zeek for connections to BSC RPC endpoints (bsc-dataseed*.binance.org); EtherHiding payloads require JavaScript content inspection at the proxy layer since the domain/IP blocklist approach fails against blockchain storage.

Detection Engineering

---
title: ClickFix-Style Run Dialog Execution Leading to WebDAV DLL Load
id: 8f2a1b7c-3e4d-4a5f-9c1b-clearfake01
status: experimental
description: Detects ClearFake/UAT-10820 infection chain where fake CAPTCHA lures coerce users into Run dialog execution of commands that mount WebDAV shares and load DLLs (e.g., pf.ch) via rundll32 or mshta.
author: Security Arsenal Threat Intelligence
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\explorer.exe'
  selection_child:
    Image|endswith:
      - '\rundll32.exe'
      - '\mshta.exe'
      - '\powershell.exe'
      - '\cmd.exe'
  selection_webdav:
    CommandLine|contains:
      - '\\'
      - '@SSL'
      - 'DavWWWRoot'
      - '.ch'
      - 'WebClient'
  condition: selection_parent and selection_child and selection_webdav
falsepositives:
  - Legitimate corporate WebDAV usage (rare in most environments)
level: high
tags:
  - attack.execution
  - attack.t1059
  - attack.t1204
  - attack.t1105
date: 2026/09/09
---
title: Suspicious Network Connection to BNB Smart Chain RPC or Known ClearFake Infrastructure
id: 7c1d9e2f-4b5a-4c6d-8e2f-clearfake02
status: experimental
description: Detects EtherHiding behavior — browser or script processes querying BNB Smart Chain RPC endpoints to retrieve malicious JavaScript, or connections to known ClearFake/BlueMoon C2 domains.
author: Security Arsenal Threat Intelligence
logsource:
  category: network_connection
  product: windows
detection:
  selection_domain:
    DestinationHostname|contains:
      - 'bsc-dataseed'
      - 'binance.org'
      - 'leaguejazire.com'
      - 'hugo-mapp.co'
      - 'msbenefit.com'
      - 'attcdn.com'
  selection_ip:
    DestinationIp:
      - '45.150.34.2'
  filter_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
  condition: (selection_domain or selection_ip) and not filter_browsers
falsepositives:
  - Legitimate Web3/dApp development activity
level: high
tags:
  - attack.command_and_control
  - attack.t1102
  - attack.t1071
date: 2026/09/09
---
title: Vidar Infostealer Anti-Analysis and Credential Theft Behavior
id: 3a5b8c1d-6f7e-4a9b-2c3d-vidar03
status: experimental
description: Detects Vidar stealer behaviors — access to browser credential stores and cryptocurrency wallet paths by unsigned non-browser processes, often following RDTSC/debugger evasion. Also detects Telegram API exfiltration staging.
author: Security Arsenal Threat Intelligence
logsource:
  category: file_event
  product: windows
detection:
  selection_paths:
    TargetFilename|contains:
      - '\Login Data'
      - '\Cookies'
      - '\Local State'
      - '\Web Data'
      - '\wallets\'
      - '\Exodus\'
      - '\Electrum\'
      - '\AppData\Roaming\Telegram Desktop\'
  filter_legit:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
      - '\Telegram.exe'
  condition: selection_paths and not filter_legit
falsepositives:
  - Enterprise backup or DLP agents reading browser stores (tune per environment)
level: high
tags:
  - attack.credential_access
  - attack.t1555
  - attack.t1552
  - attack.collection
  - attack.t1005
date: 2026/09/09

// Hunt: ClearFake WebDAV chain + BlueMoon C2 + Vidar staging — Security Arsenal OTX Hunt 2026-09-09
let KnownIOC = dynamic(["leaguejazire.com","hugo-mapp.co","msbenefit.com","attcdn.com","45.150.34.2"]);
let NetIOC = DeviceNetworkEvents
| where Timestamp > ago(14d)
| where RemoteUrl has_any (KnownIOC) or RemoteIP in (KnownIOC)
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort;
let WebDAVExec = DeviceProcessEvents
| where Timestamp > ago(14d)
| where ProcessCommandLine has_any ("DavWWWRoot","@SSL","\\\\") 
    and FileName in~ ("rundll32.exe","mshta.exe","powershell.exe","cmd.exe")
| where InitiatingProcessFileName =~ "explorer.exe"
| project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, SHA256;
let VidarStaging = DeviceFileEvents
| where Timestamp > ago(14d)
| where FolderPath has_any ("Login Data","Local State","\\wallets\\")
| where not (FileName in~ ("chrome.exe","msedge.exe","firefox.exe","brave.exe"))
| project Timestamp, DeviceName, FileName, FolderPath, SHA256;
NetIOC
| union WebDAVExec
| union VidarStaging
| sort by Timestamp desc

# Security Arsenal — OTX IOC Hunt Script: BlueMoon / ClearFake / Vidar (2026-09-09)
# Run elevated across endpoints via your RMM/EDR script module.

$IOC = @{
    Hashes = @(
        '34c7929e60aa09bffdf458f4ee0b618f65d77e1b77e161f66fb835e35c405cc4',
        '398633479c7d8c0c93616f50d1faaa7f01b5864c89de0911812da60bf90e3358',
        '3a2e69ca13d76af3d9502d352802be4d6aa00cc675da69fccab33dc3a0c914fe',
        'e42890753b9e9e08a29dab78db957677dfb9efd3dfa0aef84184d4257ad1a6f0',
        'abd28aecb2d57660bcd9455333b84d289aa883eaf5cf15def1bf0feb35833aa2',
        '779b3e1a470e589d492b99154ba11622fbaebb19b3de694f660c725411b7096d',
        'ff1b49aaec994f4c11f2c9331e739abb4bc3d6abf66ec50ce99709fba35d782b'
    )
    Domains = @('leaguejazire.com','hugo-mapp.co','msbenefit.com','attcdn.com')
    IPs     = @('45.150.34.2')
}

$findings = @()

Write-Host '[*] Checking DNS cache for malicious domains...'
$dns = Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object {
    $d = $_.Entry; $IOC.Domains | Where-Object { $d -like "*$_*" }
}
if ($dns) { $findings += '[!] DNS cache hit: ' + ($dns.Entry -join ', ') }

Write-Host '[*] Checking active network connections for malicious IPs...'
$conns = Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object { $IOC.IPs -contains $_.RemoteAddress }
if ($conns) { $findings += '[!] Active connection to C2 IP: ' + ($conns.RemoteAddress -join ', ') }

Write-Host '[*] Scanning common staging paths for known malware hashes...'
$paths = @("$env:APPDATA","$env:LOCALAPPDATA","$env:ProgramData","$env:TEMP","C:\Users\Public")
foreach ($p in $paths) {
    Get-ChildItem -Path $p -Recurse -File -ErrorAction SilentlyContinue |
        Where-Object { $_.Length -lt 50MB } | ForEach-Object {
            $h = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($IOC.Hashes -contains $h) { $findings += "[!] MALWARE HASH MATCH: $($_.FullName) [$h]" }
        }
}

Write-Host '[*] Checking persistence locations (Run keys, scheduled tasks)...'
$runKeys = @('HKCU:\Software\Microsoft\Windows\CurrentVersion\Run',
             'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run')
foreach ($rk in $runKeys) {
    Get-ItemProperty -Path $rk -ErrorAction SilentlyContinue | Get-Member -MemberType NoteProperty |
        Where-Object { $_.Definition -match 'AppData|Temp|Public|\.ch' } |
        ForEach-Object { $findings += "[!] Suspicious Run key entry in $rk : $($_.Name)" }
}
Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object {
    $_.Actions.Execute -match 'AppData|Temp|rundll32' -and $_.TaskPath -notlike '\Microsoft\*'
} | ForEach-Object { $findings += "[!] Suspicious scheduled task: $($_.TaskName) -> $($_.Actions.Execute)" }

Write-Host '[*] Checking WebDAV client service state (ClearFake staging vector)...'
$wc = Get-Service -Name WebClient -ErrorAction SilentlyContinue
if ($wc -and $wc.Status -eq 'Running') { $findings += '[!] WebClient (WebDAV) service RUNNING — investigate if unexpected' }

if ($findings.Count -gt 0) { $findings | ForEach-Object { Write-Host $_ -ForegroundColor Red } }
else { Write-Host '[+] No indicators found on this host.' -ForegroundColor Green }

Response Priorities

Immediate (0–4 hours)

• Block all pulse IOCs at DNS resolver, web proxy, and perimeter firewall: msbenefit.com, attcdn.com, leaguejazire.com, hugo-mapp.co subdomains, and 45.150.34.2.
• Push all SHA256 hashes to EDR blocklists; retro-hunt 90 days of process and file telemetry.
• Initiate emergency patching for Chrome/Edge (CVE-2026-85046) and Windows (CVE-2026-85880). If patching is not yet possible, enable network-level exploit protection and consider browser isolation for high-risk users (executives, finance, aerospace/defense program staff).
• Verify whether the WebClient (WebDAV) service is running anywhere it isn't explicitly required — disable it fleet-wide via GPO if unused.

24 Hours

• Credential-stealing malware is involved across two of three pulses (Vidar, Amatera, ZigCryptoStealer). Any host with a confirmed hash match or C2 connection must trigger full credential rotation: domain accounts, cached browser credentials, session cookies (force token revocation), and critically Azure/Entra ID refresh tokens — Vidar explicitly targets Azure tokens, enabling cloud persistence even after endpoint cleanup.
• Audit crypto-wallet access on affected endpoints and notify users to move assets from potentially compromised wallets.
• Review Entra ID sign-in logs for anomalous token usage from unfamiliar IPs following any suspected stealer execution window.

1 Week

• Architecture hardening against the attack vectors observed:
  • Deploy application control (WDAC/AppLocker) blocking unsigned DLL execution from user-writable paths — breaks both the WebDAV pf.ch load and Vidar staging.
  • Disable or restrict WebDAV client and block outbound WebDAV (TCP 445/80/443 to non-corporate WebDAV roots) at the egress proxy.
  • Alert on endpoint traffic to blockchain RPC endpoints (BSC, Ethereum public nodes) from non-developer assets — EtherHiding cannot be blocklisted, so behavioral detection is the only durable control.
  • For BlueMoon/APT31 exposure: enforce browser auto-update, deploy network detection for the exploit kit's delivery domains, and segment aerospace/finance/government-adjacent user populations behind stricter web isolation.
  • Tabletop the ClickFix/fake-CAPTCHA lure with your SOC — user-initiated Run-dialog execution bypasses most gateway controls; detection must live on the endpoint.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub