BO Team Supply Chain Intrusion, Mirax Android DTO, and Storm-2603 ToolShell Fileless Attacks: OTX Pulse Analysis — Enterprise Detection Pack

Three concurrent OTX pulses published 2026-11-05 paint a picture of a threat landscape converging on two themes: abuse of trusted infrastructure layers (hypervisors, SharePoint, mobile accessibility services) and fileless or low-footprint tradecraft designed to evade traditional EDR disk-based detection. Enterprise defenders should treat all three campaigns as active and immediately actionable.

Threat Summary

These pulses describe three distinct but methodologically aligned campaigns:

1. Black Owl (BO Team) supply chain intrusion — A sophisticated APT compromised a software developer's entire infrastructure estate: domain controllers, VMware vCenter, hypervisors, Ansible orchestration, backups, and security tooling. Initial access was achieved via CVE-2021-44228 (Log4Shell) against VMware vCenter, followed by deployment of Nanodump (LSASS credential dumping), Global Socket, and ReverseSSH for resilient C2 and lateral movement. The supply chain angle — compromising a software developer's build and orchestration environment — creates downstream risk for every consumer of that developer's products.

2. Mirax Android device takeover (DTO) — Between March and September 2026, the MiraxBot operation infected thousands of Android devices across the META region (notably India), causing millions in estimated fraud losses. Distribution relies on malicious advertisements inside low-reputation streaming apps on Google Play delivering droppers. Mirax impersonates Google Play Services using Cyrillic homoglyph characters and coerces victims into granting Accessibility Service permissions, enabling full server-side device takeover targeting banking and retail/finance applications. This is MaaS (Malware-as-a-Service) economics applied to mobile financial fraud.

3. Storm-2603 ToolShell fileless SharePoint exploitation — Threat actors exploited CVE-2025-53770 and CVE-2025-53771 (ToolShell) in on-premises Microsoft SharePoint for remote code execution, with Storm-2603 deploying Warlock ransomware post-exploitation. Critically, the actor uses the IIS worker process (w3wp.exe) as an in-memory bridge, registering malicious VirtualPathProvider components to maintain access entirely in memory without touching disk. Velociraptor and token impersonation appear in the tradecraft. CVE-2025-6264 is also referenced in the indicator set.

Collective assessment: All three campaigns bypass perimeter and disk-centric controls. BO Team owns the virtualization layer; Storm-2603 lives inside a trusted server process; Mirax weaponizes legitimate Android accessibility frameworks. Detection must shift to memory, process-lineage, and behavioral telemetry.

Threat Actor / Malware Profile

Black Owl (BO Team)

• Distribution/Initial Access: Log4Shell (CVE-2021-44228) exploitation against internet-facing VMware vCenter.
• Payload Behavior: Nanodump for LSASS memory dumping and credential theft; full estate capture including AD, backups, and orchestration (Ansible) — indicating intent to persist and destroy recovery options.
• C2 Communication: ReverseSSH tunnels and Global Socket (gs-netcat) — both abuse legitimate remote-access tooling, blending C2 into expected administrative traffic.
• Persistence: Hypervisor-level compromise; control of domain controllers and backup infrastructure ensures survival of host-level remediation.
• Anti-Analysis: Living-off-the-land tooling; operations at the virtualization layer beneath guest-OS EDR visibility.

Mirax / MiraxBot

• Distribution: Malvertising within low-reputation streaming apps on Google Play; dropper-chain installation.
• Payload Behavior: Server-side device takeover; overlay and keylogging capability against banking/retail apps; financial fraud execution.
• C2 Communication: Server-side DTO channel (MaaS-operated panels); sessions orchestrated by operators rather than automated-only.
• Persistence: Abuse of Android Accessibility Services; masquerades as Google Play Services using Cyrillic homoglyphs to defeat user scrutiny and casual app-list review.
• Anti-Analysis: Homoglyph impersonation, dropper staging, and reliance on user-granted permissions rather than exploit chains.

Storm-2603 / Warlock

• Distribution/Initial Access: ToolShell exploit chain (CVE-2025-53770/53771) against on-prem SharePoint.
• Payload Behavior: Warlock ransomware deployment post-exploitation; Velociraptor abused for intra-network execution.
• C2/Execution: Entirely in-memory within w3wp.exe; no disk artifacts for the core implant.
• Persistence: Malicious ASP.NET VirtualPathProvider registration — the implant reconstitutes in memory from web requests, surviving reboots without filesystem footprints.
• Anti-Analysis: Fileless execution, token impersonation, and residence inside a whitelisted, high-trust Microsoft process.

IOC Analysis

The pulse indicator sets are dominated by two types:

• CVEs (CVE-2021-44228, CVE-2025-53770, CVE-2025-53771, CVE-2025-6264): These are exposure indicators, not blocklist entries. SOC teams should feed them directly into vulnerability management and attack surface management platforms (Tenable, Qualys, Wiz, Defender Vulnerability Management) and cross-reference against internet-facing asset inventories. Any unpatched vCenter or on-prem SharePoint is an active intrusion waiting to be confirmed.
• File hashes (MD5/SHA1 — 19 indicators in the BO Team pulse, 20 in the Mirax pulse, 1 in the Storm-2603 pulse): Load into EDR blocklists (Defender, CrowdStrike custom IOCs, SentinelOne), proxy/SWG hash reputation where supported, and VirusTotal Enterprise / hybrid-analysis retrohunts. For Mirax, push SHA1s into mobile threat defense (MTD) platforms such as Lookout or Zimperium, since traditional endpoint tooling will not see Android payloads.

Operationalization guidance: Hashes decay quickly for MaaS tooling like Mirax (droppers are repacked per campaign wave), so prioritize behavioral detections below. CVE indicators have the longest shelf life — exploit attempts against SharePoint ToolShell remain high-confidence signals months after patch release. For the fileless Storm-2603 tradecraft, hashes are nearly irrelevant; detection must key on w3wp.exe behavior. Hash lookups can be automated via the OTX DirectConnect API, VirusTotal API, or MISP sync.

Detection Engineering

---
title: Nanodump LSASS Credential Dumping via BO Team Tradecraft
id: 9a1f3c7e-2b4d-4e6a-9c1d-b0t3am2026a1
status: experimental
description: Detects LSASS memory access patterns consistent with Nanodump usage as deployed by Black Owl (BO Team) following hypervisor/vCenter compromise
author: Security Arsenal Threat Intelligence
references:
  - https://ics-cert.kaspersky.com/publications/reports/2026/11/05/supply-chain-attack-bo-team-in-a-software-developers-infrastructure/
date: 2026/11/05
logsource:
  category: process_access
  product: windows
detection:
  selection_target:
    TargetImage|endswith: '\lsass.exe'
  selection_access:
    GrantedAccess|contains:
      - '0x1010'
      - '0x1410'
      - '0x1FFFFF'
  filter_legit:
    SourceImage|endswith:
      - '\MsMpEng.exe'
      - '\csrss.exe'
      - '\wininit.exe'
      - '\svchost.exe'
  condition: selection_target and selection_access and not filter_legit
falsepositives:
  - Legitimate security tooling performing credential guard validation
level: high
tags:
  - attack.credential_access
  - attack.t1003.001
---
title: ReverseSSH or Global Socket Tunnel Execution
id: 7c2e8a1f-5d3b-4f7c-8e2a-b0t3am2026b2
status: experimental
description: Detects execution of ReverseSSH or Global Socket (gs-netcat) binaries and associated reverse tunnel command lines used by BO Team for C2
author: Security Arsenal Threat Intelligence
references:
  - https://ics-cert.kaspersky.com/publications/reports/2026/11/05/supply-chain-attack-bo-team-in-a-software-developers-infrastructure/
date: 2026/11/05
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\gs-netcat.exe'
      - '\reversessh.exe'
      - '\rsshd.exe'
      - '\ssh.exe'
  selection_cli:
    CommandLine|contains:
      - 'gs-netcat'
      - '-s '
      - ' -R '
      - 'reversessh'
      - 'global.socket'
      - 'gsocket.io'
  condition: selection_img and selection_cli
falsepositives:
  - Legitimate administrative reverse SSH tunnels for remote support
level: medium
tags:
  - attack.command_and_control
  - attack.t1572
  - attack.t1105
---
title: Fileless SharePoint ToolShell Implant via IIS Worker Process
id: 3f9d1b6a-8c4e-4a2d-9f5b-st0rm2603c3
status: experimental
description: Detects Storm-2603 ToolShell post-exploitation behavior including suspicious child processes of w3wp.exe and in-memory VirtualPathProvider abuse on SharePoint servers
author: Security Arsenal Threat Intelligence
references:
  - https://securelist.com/storm-2603-fileless-toolshell-attack/121467/
date: 2026/11/05
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\w3wp.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\mshta.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\velociraptor.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare SharePoint administrative workflows spawning management shells
level: critical
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059
  - attack.defense_evasion
  - attack.t1134

// Storm-2603 ToolShell: suspicious w3wp.exe child processes on SharePoint servers
// + BO Team: reverse tunnel tooling execution — Microsoft Sentinel hunt
union
( DeviceProcessEvents
  | where InitiatingProcessFileName =~ "w3wp.exe"
  | where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","rundll32.exe","regsvr32.exe","mshta.exe","certutil.exe","bitsadmin.exe","velociraptor.exe")
  | project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, SHA256, ReportId
),
( DeviceProcessEvents
  | where FileName in~ ("gs-netcat.exe","reversessh.exe","rsshd.exe")
     or ProcessCommandLine has_any ("gs-netcat","reversessh","global.socket","gsocket.io")
  | project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, SHA256, ReportId
)
| order by TimeGenerated desc

# Security Arsenal IOC Hunt — BO Team / Storm-2603 / Mirax adjacent artifacts
# Run elevated on domain controllers, vCenter-adjacent Windows hosts, and SharePoint servers

$ErrorActionPreference = 'SilentlyContinue'
$report = @()

# 1) OTX Pulse file hash sweep (MD5 — BO Team + Storm-2603 indicators)
$iocHashes = @(
  '346b04985ec6c5d107ba0ddf32fe7691','5aa8c19c897176502cf8d8fc543fafc7',
  '5e04b2891635cbaa83ad619fe248e85b','68957de915e2a58339fa477f8078bdf4',
  '6d12efa1db15121f88d58b9952e301ef','719e813e527920e83349e061b5b1590f',
  '86ff08749e77d5d078e929e5f9748504','2d9ebf9c042f596f435865b40edad928'
)
$scanPaths = @("$env:TEMP","$env:ProgramData","$env:SystemRoot\Temp","$env:SystemRoot\System32\inetsrv")
foreach ($p in $scanPaths) {
  Get-ChildItem -Path $p -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
    $h = (Get-FileHash -Algorithm MD5 -Path $_.FullName).Hash.ToLower()
    if ($iocHashes -contains $h) {
      $report += [pscustomobject]@{Type='HashMatch'; Detail="$($_.FullName) == $h"}
    }
  }
}

# 2) ReverseSSH / Global Socket artifacts
Get-Process | Where-Object { $_.Name -match 'gs-netcat|reversessh|rsshd' } |
  ForEach-Object { $report += [pscustomobject]@{Type='SuspiciousProcess'; Detail="$($_.Name) PID $($_.Id)"} }
Get-NetTCPConnection -State Established |
  Where-Object { $_.RemotePort -in 443,8443,22 -and (Get-Process -Id $_.OwningProcess).Name -match 'ssh|gs-netcat|w3wp' } |
  ForEach-Object { $report += [pscustomobject]@{Type='SuspiciousConnection'; Detail="PID $($_.OwningProcess) -> $($_.RemoteAddress):$($_.RemotePort)"} }

# 3) Storm-2603 ToolShell: suspicious w3wp child processes & SharePoint web dirs
Get-CimInstance Win32_Process | Where-Object {
  $_.ParentProcessId -in (Get-Process w3wp -ErrorAction SilentlyContinue).Id -and
  $_.Name -match 'cmd|powershell|pwsh|rundll32|regsvr32|mshta|certutil|bitsadmin|velociraptor'
} | ForEach-Object { $report += [pscustomobject]@{Type='W3WP_ChildProcess'; Detail="$($_.Name): $($_.CommandLine)"} }

$spPaths = @("C:\Program Files\Common Files\microsoft shared\Web Server Extensions","C:\inetpub\wwwroot\wss")
foreach ($sp in $spPaths) {
  Get-ChildItem $sp -Recurse -Include *.aspx,*.ashx,*.dll -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-120) } |
    ForEach-Object { $report += [pscustomobject]@{Type='RecentSharePointArtifact'; Detail="$($_.FullName) modified $($_.LastWriteTime)"} }
}

# 4) Log4Shell exposure check: JNDI strings in vCenter/SharePoint log directories
Get-ChildItem "C:\ProgramData\VMware","C:\inetpub\logs" -Recurse -Include *.log -ErrorAction SilentlyContinue |
  Select-String -Pattern '\$\{jndi:' -List |
  ForEach-Object { $report += [pscustomobject]@{Type='JNDI_Probe'; Detail=$_.Path} }

# 5) Scheduled task persistence check
Get-ScheduledTask | Where-Object {
  $_.Actions.Execute -match 'powershell|cmd|rundll32|regsvr32' -and
  $_.Actions.Arguments -match 'encodedcommand|http|socket|ssh'
} | ForEach-Object { $report += [pscustomobject]@{Type='SuspiciousTask'; Detail="$($_.TaskName): $($_.Actions.Execute) $($_.Actions.Arguments)"} }

$report | Format-Table -AutoSize
$report | Export-Csv -Path "$env:USERPROFILE\Desktop\OTX_Hunt_$(Get-Date -Format 'yyyyMMdd_HHmm').csv" -NoTypeInformation
Write-Host "Hunt complete. Findings: $($report.Count)" -ForegroundColor Yellow

Response Priorities

Immediate (0–4 hours)

• Push all MD5/SHA1 indicators into EDR blocklists and MTD platforms (Mirax SHA1s specifically to mobile defense tooling).
• Block outbound traffic patterns matching Global Socket infrastructure and audit for unauthorized SSH reverse tunnels from servers (especially hypervisors and DCs).
• Verify patch status of CVE-2021-44228 on all vCenter instances and CVE-2025-53770/53771 on all on-prem SharePoint servers; isolate any unpatched, internet-facing instance pending emergency patching.
• Hunt for w3wp.exe spawning shells or script interpreters on SharePoint servers using the KQL query above.

24 Hours

• Credential exposure sweep: BO Team deployed Nanodump against LSASS and owns domain controllers — assume full AD credential compromise in any environment with matching telemetry. Force password resets for privileged accounts, rotate krbtgt twice, and revoke active sessions/refresh tokens.
• Review Accessibility Service-enabled devices in your mobile fleet for Mirax indicators; alert finance teams to monitor for fraudulent transactions originating from META-region mobile sessions.
• Audit SharePoint and vCenter authentication logs for anomalous token usage (token impersonation is in Storm-2603's toolkit).

1 Week

• Architecture hardening: Remove vCenter and SharePoint admin interfaces from direct internet exposure; place behind VPN/ZTNA gateways.
• Deploy memory-scanning capabilities (e.g., YARA-in-memory via Velociraptor — ironically the same tool Storm-2603 abuses) against IIS worker processes; implement IIS hardening to detect unauthorized VirtualPathProvider registrations.
• Segment backup and orchestration infrastructure (Ansible) away from domain trust paths BO Team exploited; enforce tiered administration.
• Implement conditional launch controls for Android Accessibility Services on corporate-managed devices and restrict sideloaded/streaming-app installation via MDM policy.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub