Brevo Supply Chain Compromise: WordPress Backdoor + ClickFix Dual-Payload Campaign — OTX Detection Pack

---
title: Brevo Supply Chain - Malicious CDN Payload Retrieval
id: 9a1f2b3c-brev-2026-0001
status: experimental
description: Detects network retrieval of the wm.zip payload or communication with known Brevo supply-chain compromise infrastructure (sendibt1.com lookalike CDN, ecomscan.com).
author: Security Arsenal Threat Intel
date: 2026/09/19
references:
    - http://sansec.io/research/brevo-supply-chain-attack
logsource:
    category: proxy
product: any
detection:
    selection_domain:
        c-dns-domain|contains:
            - 'sendibt1.com'
            - 'ecomscan.com'
    selection_url:
        c-uri|contains:
            - '/p/wm.zip'
    condition: 1 of selection_*
falsepositives:
    - None expected; sendibt1.com is a lookalike of legitimate sendibt.com infrastructure
level: critical
tags:
    - attack.t1195.002
    - attack.t1071.001
---
title: ClickFix Social Engineering - Clipboard-to-Run PowerShell Execution
id: 9a1f2b3c-brev-2026-0002
status: experimental
description: Detects the execution pattern typical of ClickFix overlays - encoded or download-cradle PowerShell launched shortly after browser activity, consistent with a user pasting a malicious command from a fake verification overlay.
author: Security Arsenal Threat Intel
date: 2026/09/19
references:
    - http://sansec.io/research/brevo-supply-chain-attack
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\explorer.exe'
            - '\RunDLL32.exe'
    selection_img:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\mshta.exe'
            - '\cmd.exe'
    selection_cli:
        CommandLine|contains:
            - ' -enc'
            - ' -e '
            - 'FromBase64String'
            - 'IEX'
            - 'Invoke-Expression'
            - 'DownloadString'
            - 'hidden'
            - 'bypass'
    condition: selection_img and selection_cli and selection_parent
falsepositives:
    - IT automation scripts; correlate with browser history for ClickFix overlay domains
level: high
tags:
    - attack.t1204.004
    - attack.t1059.001
---
title: WordPress Supply Chain Backdoor - Rogue Plugin or Admin Creation
id: 9a1f2b3c-brev-2026-0003
status: experimental
description: Detects suspicious PHP file creation in WordPress plugin directories or new plugin installation events consistent with the Brevo session-riding backdoor installer.
author: Security Arsenal Threat Intel
date: 2026/09/19
references:
    - http://sansec.io/research/brevo-supply-chain-attack
logsource:
    category: file_event
    product: linux
    service: auditd
    product: windows
    service: sysmon
detection:
    selection_path:
        TargetFilename|contains:
            - 'wp-content/plugins/'
            - 'wp-content/mu-plugins/'
            - 'wp-content/themes/'
    selection_ext:
        TargetFilename|endswith:
            - '.php'
            - '.phtml'
            - '.php5'
    filter_legit_updates:
        Image|contains:
            - 'wp-cli'
            - 'composer'
    condition: selection_path and selection_ext and not filter_legit_updates
falsepositives:
    - Legitimate plugin/theme updates - correlate with maintenance windows and admin activity logs
level: high
tags:
    - attack.t1505.003
    - attack.t1136.001

// Brevo Supply Chain Campaign - Network & Execution Hunt (Microsoft Sentinel)
// Hunt for C2/staging communication, payload hashes, and ClickFix-style execution
let BrevoIOCs = dynamic(["sendibt1.com", "cdn10.sendibt1.com", "ecomscan.com"]);
let BrevoHashes = dynamic([
    "26166cd87ff07e7a50317a24126d14b262e842c5715585636dee3ab3f227ddca",
    "4af488d79aef7daa12b1c18f0cce28b7edadccb8b6b0fb8d50d1d53a9a7c2df7",
    "58a5c601c9df7ca2120435588fc39f97712d9b878795f6ee500590099a432308",
    "9b62c12bc5c7feb9802f58e6cf75a368690df3c754e37cc64483a92acacf87a5",
    "f67d572d2d30407b3f470904326411450763108980cdad89550fbb221fb06782"
]);
let Lookback = 14d;
let NetworkHits = DeviceNetworkEvents
    | where TimeGenerated > ago(Lookback)
    | where RemoteUrl has_any (BrevoIOCs) or RemoteUrl endswith "wm.zip";
let HashHits = DeviceFileEvents
    | where TimeGenerated > ago(Lookback)
    | where SHA256 in~ (BrevoHashes)
    | project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName;
let ClickFixExec = DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where FileName in~ ("powershell.exe", "pwsh.exe", "mshta.exe", "cmd.exe")
    | where ProcessCommandLine has_any ("FromBase64String", "IEX", "Invoke-Expression", "DownloadString", " -enc ", "bypass")
    | where InitiatingProcessFileName =~ "explorer.exe"
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, AccountName;
NetworkHits
| project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, ActionType
| union (HashHits | extend RemoteUrl="", RemoteIP="", ActionType="HashMatch")
| union (ClickFixExec | extend RemoteUrl="", RemoteIP="", ActionType="ClickFixExecution", InitiatingProcessFileName=FileName)
| sort by TimeGenerated desc

# Brevo Supply Chain IOC Hunt - Windows Endpoints & Web Servers
# Checks for malicious hashes, ClickFix artifacts, DNS cache hits, and WP backdoor indicators
# Run elevated. Output: CSV to $env:TEMP\brevo_hunt_results.csv

$results = @()

$malHashes = @(
    "26166cd87ff07e7a50317a24126d14b262e842c5715585636dee3ab3f227ddca",
    "4af488d79aef7daa12b1c18f0cce28b7edadccb8b6b0fb8d50d1d53a9a7c2df7",
    "58a5c601c9df7ca2120435588fc39f97712d9b878795f6ee500590099a432308",
    "9b62c12bc5c7feb9802f58e6cf75a368690df3c754e37cc64483a92acacf87a5",
    "f67d572d2d30407b3f470904326411450763108980cdad89550fbb221fb06782"
)

# 1. DNS cache check for malicious domains
Write-Host "[*] Checking DNS cache for campaign domains..."
$dns = Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object {
    $_.Entry -match "sendibt1\.com|ecomscan\.com"
}
foreach ($d in $dns) {
    $results += [pscustomobject]@{Type="DNSCache"; Indicator=$d.Entry; Detail="Resolves to $($d.Data)"; Host=$env:COMPUTERNAME}
}

# 2. Active/historical network connections
Write-Host "[*] Checking network connections..."
Get-NetTCPConnection -ErrorAction SilentlyContinue | ForEach-Object {
    try {
        $r = Resolve-DnsName $_.RemoteAddress -ErrorAction Stop -QuickTimeout
        if ($r.NameHost -match "sendibt1\.com|ecomscan\.com") {
            $results += [pscustomobject]@{Type="NetConnection"; Indicator=$r.NameHost; Detail="State: $($_.State) PID: $($_.OwningProcess)"; Host=$env:COMPUTERNAME}
        }
    } catch {}
}

# 3. WordPress plugin hash sweep (adjust root paths for your web hosts)
Write-Host "[*] Sweeping WordPress directories for malicious hashes..."
$wpRoots = @("C:\inetpub\wwwroot", "C:\xampp\htdocs", "/var/www/html")
foreach ($root in $wpRoots) {
    if (Test-Path $root) {
        Get-ChildItem -Path $root -Recurse -Include *.php,*.zip -ErrorAction SilentlyContinue | ForEach-Object {
            $h = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($malHashes -contains $h) {
                $results += [pscustomobject]@{Type="MaliciousFile"; Indicator=$h; Detail=$_.FullName; Host=$env:COMPUTERNAME}
            }
        }
    }
}

# 4. ClickFix artifact check - Run dialog history (MRU) for suspicious commands
Write-Host "[*] Checking RunMRU for ClickFix-style pasted commands..."
$runMru = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU"
if (Test-Path $runMru) {
    (Get-ItemProperty $runMru).PSObject.Properties | Where-Object {
        $_.Value -match "powershell|mshta|certutil|curl|bitsadmin|IEX"
    } | ForEach-Object {
        $results += [pscustomobject]@{Type="RunMRU"; Indicator=$_.Name; Detail=$_.Value; Host=$env:COMPUTERNAME}
    }
}

# 5. Scheduled tasks created since campaign start (2026-09-14)
Write-Host "[*] Checking scheduled tasks created after 2026-09-14..."
Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object {
    $_.Date -gt (Get-Date "2026-09-14") -and $_.TaskPath -notlike "\Microsoft*"
} | ForEach-Object {
    $results += [pscustomobject]@{Type="ScheduledTask"; Indicator=$_.TaskName; Detail="Created: $($_.Date)"; Host=$env:COMPUTERNAME}
}

# Output
if ($results.Count -gt 0) {
    $results | Format-Table -AutoSize
    $results | Export-Csv "$env:TEMP\brevo_hunt_results.csv" -NoTypeInformation
    Write-Host "[!] $($results.Count) potential hits. Results saved to $env:TEMP\brevo_hunt_results.csv" -ForegroundColor Red
} else {
    Write-Host "[+] No indicators found on this host." -ForegroundColor Green
}