Bumblebee, KimJongRAT & Djinn Stealer: Multi-Vector Credential Theft Campaigns — OTX Pulse Intelligence Brief

---
title: Bumblebee Loader Execution via Trojanized IT Tool Installer
id: 7a3c1f2e-8b4d-4a6e-9c2f-1d5e8a7b3c9f
status: experimental
description: >
  Detects Bumblebee malware execution patterns associated with trojanized
  ManageEngine OpManager or Angry IP Scanner installers delivered via
  SEO poisoning campaigns. Bumblebee (S1039) is a loader that injects
  into legitimate processes and establishes AdaptixC2 C2 communications
  before delivering Akira ransomware.
references:
  - https://thedfirreport.com/2025/08/05/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-2/
author: Security Arsenal Threat Intelligence
date: 2026/06/30
tags:
  - attack.execution
  - attack.t1059
  - attack.t1055
  - attack.initial_access
  - attack.t1566.002
logsource:
  product: windows
  category: process_creation
detection:
  selection_installer:
    Image|endswith:
      - '\\opmanager_setup.exe'
      - '\\angryipscanner_setup.exe'
      - '\\OpManager.exe'
    CommandLine|contains:
      - 'opmanager.pro'
      - 'angryipscanner.org'
  selection_bumblebee_execution:
    ParentImage|endswith:
      - '\\msiexec.exe'
      - '\\rundll32.exe'
    Image|endswith:
      - '\\rundll32.exe'
      - '\\regsvr32.exe'
      - '\\wmic.exe'
    CommandLine|contains:
      - 'DllRegisterServer'
      - '#'
      - 'load'
  selection_rustdesk_abuse:
    Image|endswith:
      - '\\rustdesk.exe'
    CommandLine|contains:
      - '--password'
      - '--get-id'
      - '--option'
  filter_legitimate:
    Image|endswith:
      - '\\msiexec.exe'
    CommandLine|contains:
      - 'manageengine.com'
      - 'angryip.org'
  condition: (selection_installer and not filter_legitimate) or selection_bumblebee_execution or selection_rustdesk_abuse
falsepositives:
  - Legitimate ManageEngine or Angry IP Scanner installations from official sources
  - Authorized RustDesk remote support sessions
level: high

---
title: TaskWeaver Node.js Loader and Djinn Stealer C2 Activity
id: 9f2e4a7c-3b6d-48e1-8a5f-7c2d9b1e4f3a
status: experimental
description: >
  Detects TaskWeaver Node.js loader execution patterns and Djinn Stealer
  C2 communications following exploitation of CVE-2026-48558 in SimpleHelp
  RMM software. TaskWeaver is a heavily obfuscated Node.js loader that
  delivers Djinn Stealer for credential exfiltration via Azure dev tunnels.
references:
  - https://blackpointcyber.com/blog/a-djinn-in-the-machine-taskweavers-node-js-intrusion-chain/
author: Security Arsenal Threat Intelligence
date: 2026/06/30
tags:
  - attack.execution
  - attack.t1059.007
  - attack.t1219
  - attack.exfiltration
logsource:
  product: windows
  category: process_creation
detection:
  selection_nodejs_suspicious:
    Image|endswith:
      - '\\node.exe'
      - '\\nodejs.exe'
    CommandLine|contains:
      - '-e'
      - 'eval'
      - 'require'
      - 'child_process'
      - 'Buffer.from'
      - 'base64'
  selection_devtunnels_c2:
    Image|endswith:
      - '\\node.exe'
      - '\\powershell.exe'
      - '\\curl.exe'
      - '\\wget.exe'
    CommandLine|contains:
      - 'dev-tunnels.com'
      - 'a.dev-tunnels.com'
  selection_simplehelp_exploit:
    Image|endswith:
      - '\\cmd.exe'
      - '\\powershell.exe'
      - '\\wmic.exe'
    ParentImage|endswith:
      - '\\SimpleService.exe'
      - '\\SimpleHelp.exe'
  condition: selection_nodejs_suspicious or selection_devtunnels_c2 or selection_simplehelp_exploit
falsepositives:
  - Legitimate Node.js development activity
  - Authorized Azure dev tunnels usage by development teams
  - Legitimate SimpleHelp remote support operations
level: high

---
title: KimJongRAT C2 Beaconing via LOTS Infrastructure
id: 3b8c5f2a-7e1d-4a9c-8f3b-6d2e9c1a4b7e
status: experimental
description: >
  Detects KimJongRAT and MeshAgent C2 communications to corpsecs.com and
  servequake.com infrastructure used by Kimsuky APT group. KimJongRAT
  combines infostealer and RAT capabilities, distributed via GitHub
  Releases through phishing campaigns targeting Japanese organizations.
references:
  - https://sect.iij.ad.jp/blog/2026/06/continuous-evolution-of-kimjongrat-2026/
author: Security Arsenal Threat Intelligence
date: 2026/06/30
tags:
  - attack.command_and_control
  - attack.t1071.001
  - attack.t1105
  - attack.t1219
logsource:
  product: windows
  category: network_connection
detection:
  selection_c2_domains:
    DestinationHostname|endswith:
      - '.corpsecs.com'
      - '.servequake.com'
    DestinationHostname|contains:
      - 'lutkdd.corpsecs.com'
      - 'pxqtkc.corpsecs.com'
      - 'googleoba.servequake.com'
  selection_c2_ports:
    DestinationHostname|endswith:
      - '.corpsecs.com'
      - '.servequake.com'
    DestinationPort:
      - 8443
      - 443
      - 8080
  selection_meshagent:
    Image|endswith:
      - '\\meshagent.exe'
      - '\\MeshAgent.exe'
    DestinationHostname|contains:
      - '.corpsecs.com'
      - '.servequake.com'
      - 'github.com'
  selection_github_download:
    Image|endswith:
      - '\\powershell.exe'
      - '\\curl.exe'
      - '\\bitsadmin.exe'
    CommandLine|contains:
      - 'github.com'
      - 'releases/download'
      - 'servequake.com'
      - 'corpsecs.com'
  condition: selection_c2_domains or selection_c2_ports or selection_meshagent or selection_github_download
falsepositives:
  - Legitimate use of Dynamic DNS services on servequake.com
  - Authorized MeshAgent RMM deployment
level: critical


kql
// Multi-pulse IOC hunt: Bumblebee, TaskWeaver/Djinn, KimJongRAT, JINX-0164, Langflow exploitation
// Hunt across network, process, and file events for OTX pulse indicators
let _iocIPs = dynamic(["172.96.137.160", "96.126.130.126", "104.200.67.46", "45.207.216.55", "89.36.224.5"]);
let _iocDomains = dynamic(["opmanager.pro", "angryipscanner.org", "driver-updater.net", "live.ong", "corpsecs.com", "servequake.com", "dev-tunnels.com", "teamicrosoft.com", "live.us.org"]);
let _iocHostnames = dynamic(["lutkdd.corpsecs.com", "pxqtkc.corpsecs.com", "googleoba.servequake.com", "a.dev-tunnels.com", "login.teamicrosoft.com", "teams.live.us.org", "www.driver-updater.net", "www.live.us.org"]);
let _iocHashes = dynamic(["a14506c6fb92a5af88a6a44d273edafe10d69ee3d85c8b2a7ac458a22edf68d2", "00cc86d1144020c24c8fbb3a8dc6b908926497ebd23be3bf854360f93d1c8f4c", "f4a72600a3735c2a4d843875ea61bbb6f935a1af51a81f2fbc992ce11ba94afc", "b6cab0b3aa8e56e2427f486c74588d598ae58bb0cbc0eda6939fe171cb0aed17", "9758e76b601798a30d903bf05052a53df80451e5c156548ce9da828f608b6470", "221a39856b37e3c682f62427f1e6b965b36a2405764689c914672770a01a1fa9"]);
let _iocURLs = dynamic(["http://89.36.224.5/troubleshoot/mac/install.sh", "http://googleoba.servequake.com:8443/agent.ashx", "https://lutkdd.corpsecs.com", "http://45.207.216.55:8084/slt"]);
union
(
  DeviceNetworkEvents
  | where RemoteIP in (_iocIPs)
     or RemoteUrl has_any (_iocURLs)
     or RemoteUrl has_any (_iocDomains)
     or RemoteUrl has_any (_iocHostnames)
  | extend MatchType = "Network_IP_or_URL"
  | project TimeGenerated, DeviceName, RemoteIP, RemoteUrl, RemotePort, InitiatingProcessFileName, MatchType, ActionType
),
(
  DeviceProcessEvents
  | where SHA256 in (_iocHashes)
     or InitiatingProcessSHA256 in (_iocHashes)
     or (ProcessCommandLine has_any (_iocDomains) or ProcessCommandLine has_any (_iocHostnames))
     or (ProcessCommandLine has "dev-tunnels.com" and ProcessCommandLine has "node")
     or (ProcessCommandLine has "corpsecs.com" or ProcessCommandLine has "servequake.com")
     or (ProcessCommandLine has "github.com" and ProcessCommandLine has "releases/download")
     or (FileName =~ "meshagent.exe")
     or (FileName =~ "rustdesk.exe" and ProcessCommandLine has "--password")
     or (InitiatingProcessFileName =~ "SimpleService.exe" or InitiatingProcessFileName =~ "SimpleHelp.exe")
  | extend MatchType = "Process_Hash_or_CommandLine"
  | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, SHA256, InitiatingProcessFileName, MatchType, ActionType
),
(
  DeviceFileEvents
  | where SHA256 in (_iocHashes)
     or FileName endswith "meshagent.exe"
     or FileName endswith "OpManager.exe"
  | extend MatchType = "File_Hash"
  | project TimeGenerated, DeviceName, FileName, SHA256, FolderPath, MatchType, ActionType
)
| summarize HitCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by DeviceName, MatchType, ActionType
| order by FirstSeen desc


powershell
<#
.SYNOPSIS
  Security Arsenal OTX Pulse IOC Hunt Script
  Targets: Bumblebee, TaskWeaver/Djinn Stealer, KimJongRAT/MeshAgent, AUDIOFIX/MINIRAT, Langflow exploitation
.DESCRIPTION
  Hunts for network connections, file hashes, scheduled tasks, registry persistence,
  and suspicious process patterns across endpoints. Designed for enterprise SOC teams
  to operationalize OTX pulse indicators.
#>

$IOC_IPs = @(
  "172.96.137.160",
  "96.126.130.126",
  "104.200.67.46",
  "45.207.216.55",
  "89.36.224.5"
)

$IOC_Domains = @(
  "opmanager.pro",
  "angryipscanner.org",
  "driver-updater.net",
  "live.ong",
  "lutkdd.corpsecs.com",
  "pxqtkc.corpsecs.com",
  "googleoba.servequake.com",
  "a.dev-tunnels.com",
  "login.teamicrosoft.com",
  "teams.live.us.org",
  "www.driver-updater.net"
)

$IOC_Hashes = @(
  "a14506c6fb92a5af88a6a44d273edafe10d69ee3d85c8b2a7ac458a22edf68d2",
  "00cc86d1144020c24c8fbb3a8dc6b908926497ebd23be3bf854360f93d1c8f4c",
  "f4a72600a3735c2a4d843875ea61bbb6f935a1af51a81f2fbc992ce11ba94afc",
  "b6cab0b3aa8e56e2427f486c74588d598ae58bb0cbc0eda6939fe171cb0aed17",
  "9758e76b601798a30d903bf05052a53df80451e5c156548ce9da828f608b6470",
  "221a39856b37e3c682f62427f1e6b965b36a2405764689c914672770a01a1fa9"
)

$SuspiciousProcesses = @("meshagent", "rustdesk", "node")

Write-Host "=== Security Arsenal OTX Pulse IOC Hunt ===" -ForegroundColor Cyan
Write-Host "Started: $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')" -ForegroundColor Gray
Write-Host ""

# --- Check active network connections ---
Write-Host "[*] Checking active network connections..." -ForegroundColor Yellow
$connections = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
  Where-Object { $_.RemoteAddress -in $IOC_IPs }

if ($connections) {
  foreach ($conn in $connections) {
    $proc = Get-Process -Id $conn.OwningProcess -ErrorAction SilentlyContinue
    Write-Host "[!] ALERT: Active connection to IOC IP $($conn.RemoteAddress):$($conn.RemotePort)" -ForegroundColor Red
    Write-Host "    PID: $($conn.OwningProcess), Process: $($proc.ProcessName)" -ForegroundColor Red
  }
} else {
  Write-Host "[+] No active connections to IOC IPs found." -ForegroundColor Green
}

# --- Check DNS cache for IOC domains ---
Write-Host ""
Write-Host "[*] Checking DNS resolver cache..." -ForegroundColor Yellow
$dnsCache = Get-DnsClientCache -ErrorAction SilentlyContinue |
  Where-Object {
    foreach ($domain in $IOC_Domains) {
      if ($_.Entry -match $domain) { return $true }
    }
    return $false
  }

if ($dnsCache) {
  foreach ($entry in $dnsCache) {
    Write-Host "[!] ALERT: IOC domain found in DNS cache: $($entry.Entry) -> $($entry.Data)" -ForegroundColor Red
  }
} else {
  Write-Host "[+] No IOC domains found in DNS cache." -ForegroundColor Green
}

# --- Check running processes against suspicious list and hashes ---
Write-Host ""
Write-Host "[*] Checking running processes..." -ForegroundColor Yellow
$processes = Get-Process -ErrorAction SilentlyContinue |
  Where-Object { $_.ProcessName -in $SuspiciousProcesses }

if ($processes) {
  foreach ($proc in $processes) {
    $path = $proc.Path
    if ($path) {
      $hash = (Get-FileHash -Path $path -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
      $hashMatch = $false
      if ($hash -and $IOC_Hashes -contains $hash.ToLower()) {
        $hashMatch = $true
      }
      $color = if ($hashMatch) { 'Red' } else { 'Yellow' }
      Write-Host "[!] Suspicious process: $($proc.ProcessName) (PID: $($proc.Id))" -ForegroundColor $color
      Write-Host "    Path: $path" -ForegroundColor $color
      Write-Host "    SHA256: $hash" -ForegroundColor $color
      if ($hashMatch) {
        Write-Host "    *** HASH MATCHES KNOWN IOC ***" -ForegroundColor Red
      }
    }
  }
} else {
  Write-Host "[+] No suspicious processes from watchlist found running." -ForegroundColor Green
}

# --- Check scheduled tasks for persistence (Bumblebee TTP) ---
Write-Host ""
Write-Host "[*] Checking scheduled tasks for persistence..." -ForegroundColor Yellow
$scheduledTasks = Get-ScheduledTask -ErrorAction SilentlyContinue |
  Where-Object {
    $_.State -ne 'Disabled' -and
    ($_.Actions.Execute -match 'rundll32|regsvr32|node|powershell|cmd|meshagent|rustdesk' -or
     $_.Actions.Arguments -match 'rundll32|regsvr32|corpsecs|servequake|dev-tunnels|opmanager|angryipscanner')
  }

if ($scheduledTasks) {
  foreach ($task in $scheduledTasks) {
    Write-Host "[!] Suspicious scheduled task: $($task.TaskName)" -ForegroundColor Red
    Write-Host "    Path: $($task.TaskPath)" -ForegroundColor Red
    foreach ($action in $task.Actions) {
      Write-Host "    Execute: $($action.Execute) $($action.Arguments)" -ForegroundColor Red
    }
  }
} else {
  Write-Host "[+] No suspicious scheduled tasks found." -ForegroundColor Green
}

# --- Check registry persistence ---
Write-Host ""
Write-Host "[*] Checking registry Run keys..." -ForegroundColor Yellow
$runKeys = @(
  "HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run",
  "HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce",
  "HKCU:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run",
  "HKCU:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce"
)

foreach ($key in $runKeys) {
  if (Test-Path $key) {
    $values = Get-ItemProperty -Path $key -ErrorAction SilentlyContinue
    if ($values) {
      $valueNames = $values.PSObject.Properties.Name | Where-Object { $_ -notin @('PSPath', 'PSParentPath', 'PSChildName', 'PSDrive', 'PSProvider') }
      foreach ($name in $valueNames) {
        $val = $values.$name
        if ($val -match 'meshagent|rustdesk|node\.exe|rundll32.*#|corpsecs|servequake|dev-tunnels') {
          Write-Host "[!] ALERT: Suspicious registry Run value: $name = $val" -ForegroundColor Red
          Write-Host "    Key: $key" -ForegroundColor Red
        }
      }
    }
  }
}
Write-Host "[+] Registry Run key scan complete." -ForegroundColor Green

# --- Check for SimpleHelp installation (CVE-2026-48558 exposure) ---
Write-Host ""
Write-Host "[*] Checking for SimpleHelp RMM installation..." -ForegroundColor Yellow
$simpleHelp = Get-ChildItem -Path "C:\\Program Files*","C:\\Program Files (x86)" -Filter "SimpleHelp*" -Directory -ErrorAction SilentlyContinue
if ($simpleHelp) {
  Write-Host "[!] WARNING: SimpleHelp RMM detected - verify CVE-2026-48558 patch status" -ForegroundColor Red
  foreach ($dir in $simpleHelp) {
    Write-Host "    Install path: $($dir.FullName)" -ForegroundColor Red
  }
} else {
  Write-Host "[+] SimpleHelp RMM not found on this system." -ForegroundColor Green
}

# --- Check hosts file for IOC domain redirects ---
Write-Host ""
Write-Host "[*] Checking hosts file for IOC domains..." -ForegroundColor Yellow
$hostsContent = Get-Content "$env:windir\\System32\\drivers\\etc\\hosts" -ErrorAction SilentlyContinue
if ($hostsContent) {
  foreach ($line in $hostsContent) {
    foreach ($domain in $IOC_Domains) {
      if ($line -match $domain) {
        Write-Host "[!] ALERT: IOC domain found in hosts file: $line" -ForegroundColor Red
      }
    }
  }
}
Write-Host "[+] Hosts file scan complete." -ForegroundColor Green

Write-Host ""
Write-Host "=== IOC Hunt Complete ===" -ForegroundColor Cyan
Write-Host "Finished: $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')" -ForegroundColor Gray
Write-Host ""
Write-Host "Remediation: Any [!] ALERT entries require immediate investigation." -ForegroundColor Yellow
Write-Host "Contact your SOC team or Security Arsenal IR for assistance." -ForegroundColor Yellow