BlueNoroff Zoom Social Engineering Kit: Detecting and Blocking Crypto-Targeted Phishing Campaigns

---
title: Suspicious Zoom/Teams Typosquatted Domain Access
id: 8f4c2d1a-7e9b-4f5c-9a3b-2d1e4f5a6b7c
status: experimental
description: Detects access to Zoom or Microsoft Teams domains with suspicious typosquatting characteristics
references:
  - https://thehackernews.com/2026/07/bluenoroff-zoom-phishing-kit-profiles.html
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.initial_access
  - attack.t1566.002
  - attack.credential_access
logsource:
  category: proxy
  product: any
detection:
  selection:
    cs-host|contains:
      - 'zoomus'
      - 'teams-meet'
      - 'msteams-login'
      - 'zoom-meeting'
    cs-method: 'GET'
  filter_legitimate:
    cs-host|contains:
      - 'zoom.us'
      - 'teams.microsoft.com'
  condition: selection and not filter_legitimate
falsepositives:
  - Internal testing of videoconferencing alternatives
  - Misconfigured proxy logs
level: high
---
title: Suspicious Process Spawn from Videoconferencing Applications
id: 3d7a1b9c-5e2f-4a8d-9c1e-3f2a4b5c6d7e
status: experimental
description: Detects unusual child processes spawned from Zoom or Teams executables indicative of payload delivery
references:
  - https://thehackernews.com/2026/07/bluenoroff-zoom-phishing-kit-profiles.html
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.execution
  - attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\Zoom.exe'
      - '\Teams.exe'
      - '\mtc.exe'
  selection_suspicious:
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
  filter_legitimate:
    CommandLine|contains:
      - 'C:\Program Files\'
      - 'C:\Program Files (x86)\'
  condition: selection_parent and selection_suspicious and not filter_legitimate
falsepositives:
  - Legitimate administrative troubleshooting
  - Authorized automation scripts
level: high
---
title: Cryptocurrency Wallet File Access from Unusual Process
id: 7e9c3d1a-2f5b-4c8d-9a2e-4c5d6e7f8a9b
status: experimental
description: Detects processes accessing cryptocurrency wallet files from non-standard locations
references:
  - https://thehackernews.com/2026/07/bluenoroff-zoom-phishing-kit-profiles.html
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.collection
  - attack.t1005
logsource:
  category: file_access
  product: windows
detection:
  selection_target:
    TargetFilename|contains:
      - '\wallet.dat'
      - '\keystore'
      - '.wallet'
      - '\AppData\Roaming\'
  selection_suspicious_process:
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\unknown.exe'
  filter_legitimate:
    Image|endswith:
      - '\explorer.exe'
      - '\chrome.exe'
      - '\firefox.exe'
      - '\edge.exe'
  condition: selection_target and selection_suspicious_process and not filter_legitimate
falsepositives:
  - User manually managing wallet files
  - Legitimate backup operations
level: critical

// Hunt for suspicious videoconferencing domain connections
let suspicious_domains = dynamic(['zoomus', 'teams-meet', 'msteams-login', 'zoom-meeting', 'zoom-video', 'teams-connect']);
let legitimate_domains = dynamic(['zoom.us', 'teams.microsoft.com', 'zoom.com']);
DeviceNetworkEvents
| where Timestamp >= ago(7d)
| where RemoteUrl has_any (suspicious_domains) 
| where RemoteUrl !has_any (legitimate_domains)
| extend is_typosquat = iff(RemoteUrl matches regex @"(zoom[^\s]*\.us|teams[^\s]*\.microsoft\.com)", false, true)
| where is_typosquat == true
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, InitiatingProcessCommandLine
| order by Timestamp desc

// Detect suspicious child processes from videoconferencing apps
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where InitiatingProcessFileName in ('Zoom.exe', 'Teams.exe', 'mtc.exe')
| where FileName in ('powershell.exe', 'cmd.exe', 'wscript.exe', 'cscript.exe', 'mshta.exe')
| where not(InitiatingProcessCommandLine contains "Program Files" or InitiatingProcessCommandLine contains "Program Files (x86)")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc

// Detect access to cryptocurrency wallet files
DeviceFileEvents
| where Timestamp >= ago(7d)
| where FileName in ('wallet.dat', 'keystore') or FileName endswith '.wallet'
| where InitiatingProcessFileName !in ('explorer.exe', 'chrome.exe', 'firefox.exe', 'msedge.exe', 'WalletApp.exe')
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc

-- Hunt for suspicious videoconferencing process executions
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, StartTime
FROM pslist()
WHERE Name =~ '(Zoom|Teams|mtc)\.exe'
  AND CommandLine =~ '(powershell|cmd|wscript|cscript|mshta)'
  AND NOT Exe =~ '(Program Files)'

-- Scan for cryptocurrency wallet file access patterns
SELECT FullPath, Size, Mtime, Atime, Mode, Sys.pid
FROM glob(globs='/*/*.wallet', root='/')
WHERE Mtime > now() - 7*24*60*60

-- Identify network connections to suspicious domains
SELECT RemoteAddress, RemotePort, Family, State, Pid, ProcessName, Started
FROM netstat()
WHERE RemoteAddress =~ '(zoomus|teams-meet|zoom-meeting)'
  AND NOT RemoteAddress =~ '(zoom\.us|teams\.microsoft\.com)'

# BlueNoroff Zoom Phishing Kit Remediation Script
# Run as Administrator

# Function to write logs
function Write-Log {
    param([string]$message)
    $timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
    Write-Host "[$timestamp] $message" -ForegroundColor Cyan
}

Write-Log "Starting BlueNoroff threat remediation..."

# 1. Block known typosquatted domains via hosts file
Write-Log "Updating hosts file to block typosquatted domains..."
$hostsPath = "$env:SystemRoot\System32\drivers\etc\hosts"
$typosquatDomains = @(
    "*.zoomus.com",
    "*.teams-meet.com",
    "*.msteams-login.com",
    "*.zoom-meeting.com",
    "*.zoom-video.com",
    "*.teams-connect.com"
)

$hostsContent = Get-Content $hostsPath -ErrorAction SilentlyContinue
$backupNeeded = $false

foreach ($domain in $typosquatDomains) {
    $entry = "0.0.0.0 $domain"
    if ($hostsContent -notcontains $entry) {
        Add-Content -Path $hostsPath -Value $entry -ErrorAction SilentlyContinue
        Write-Log "Blocked domain: $domain"
        $backupNeeded = $true
    }
}

if ($backupNeeded) {
    Copy-Item -Path $hostsPath -Destination "$hostsPath.backup" -Force
    Write-Log "Hosts file backed up to $hostsPath.backup"
}

# 2. Create Windows Firewall rule to block suspicious domains
Write-Log "Configuring Windows Firewall rules..."
$ruleName = "Block BlueNoroff Typosquatted Domains"
$existingRule = Get-NetFirewallRule -DisplayName $ruleName -ErrorAction SilentlyContinue

if (-not $existingRule) {
    New-NetFirewallRule -DisplayName $ruleName -Direction Outbound -Action Block -RemoteAddress "1.0.0.0/8" -Profile Any -Enabled False -ErrorAction SilentlyContinue
    Write-Log "Created base firewall rule: $ruleName"
}

# 3. Identify and quarantine processes from unusual locations
Write-Log "Scanning for suspicious Zoom/Teams processes..."
$suspiciousProcesses = Get-Process | Where-Object { 
    ($_.ProcessName -match '^(Zoom|Teams|mtc)$') -and 
    ($_.Path -notmatch '^C:\\Program Files' -and $_.Path -notmatch '^C:\\Program Files \(x86\)')
}

if ($suspiciousProcesses) {
    foreach ($proc in $suspiciousProcesses) {
        Write-Log "SUSPICIOUS: $($proc.ProcessName) running from unusual path: $($proc.Path)"
        Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue
        
        # Quarantine the executable
        $quarantinePath = "C:\Quarantine\BlueNoroff"
        if (-not (Test-Path $quarantinePath)) {
            New-Item -ItemType Directory -Path $quarantinePath -Force | Out-Null
        }
        Move-Item -Path $proc.Path -Destination "$quarantinePath\$(Split-Path $proc.Path -Leaf)" -Force -ErrorAction SilentlyContinue
    }
} else {
    Write-Log "No suspicious processes detected."
}

# 4. Scan for wallet file access patterns
Write-Log "Scanning for recent cryptocurrency wallet file access..."
$walletExtensions = @('*.wallet', '*.dat', '*.keystore')
$recentAccess = Get-ChildItem -Path $env:APPDATA -Include $walletExtensions -Recurse -ErrorAction SilentlyContinue | 
    Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) }

if ($recentAccess) {
    Write-Log "WARNING: Recently modified wallet files detected:"
    foreach ($file in $recentAccess) {
        Write-Log "  - $($file.FullName) (Modified: $($file.LastWriteTime))"
    }
    Write-Log "ACTION REQUIRED: Manually verify these files and consider moving cold wallets offline."
}

# 5. Enable PowerShell script block logging for future detection
Write-Log "Configuring PowerShell logging..."
$registryPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging"
if (-not (Test-Path $registryPath)) {
    New-Item -Path $registryPath -Force | Out-Null
}
Set-ItemProperty -Path $registryPath -Name "EnableScriptBlockLogging" -Value 1 -Type DWord -Force
Set-ItemProperty -Path $registryPath -Name "EnableScriptBlockInvocationLogging" -Value 1 -Type DWord -Force

Write-Log "BlueNoroff threat remediation complete."
Write-Log "IMPORTANT: Educate users about verifying videoconferencing invitations and reporting suspicious domains."