Bumblebee Loader, The Gentlemen RaaS, and Ousaban: OTX Pulse Analysis — SEO Poisoning and Geofenced Banking Trojans

---
title: Potential Trojanized Installer Execution - SEO Poisoning
id: a1b2c3d4-5678-90ab-cdef-1234567890ab
description: Detects execution of processes often spawned by trojanized installers mimicking IT tools, indicative of Bumblebee or similar loaders.
status: experimental
date: 2026/07/02
author: Security Arsenal
tags:
  - attack.initial_access
  - attack.t1189
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\setup.exe'
      - '\install.exe'
      - '\msiexec.exe'
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\regsvr32.exe'
    CommandLine|contains:
      - 'download'
      - 'http://'
  condition: selection
falsepositives:
  - Legitimate software installations
level: high
---
title: Reconnaissance Tool Usage - The Gentlemen Tactics
id: b2c3d4e5-6789-01bc-def2-345678901234
description: Detects reconnaissance activity associated with The Gentlemen group using network scanners or AD enumeration tools.
status: experimental
date: 2026/07/02
author: Security Arsenal
tags:
  - attack.discovery
  - attack.t1018
logsource:
  category: process_creation
  product: windows
detection:
  selection_tools:
    Image|endswith:
      - '\Advanced_IP_Scanner.exe'
      - '\netsh.exe'
      - '\nslookup.exe'
  selection_netsh:
    Image|endswith: '\netsh.exe'
    CommandLine|contains: 'trace'
  selection_sharpadws:
    Image|contains: 'SharpADWS'
  condition: 1 of selection*
falsepositives:
  - System administration
level: medium
---
title: VBS Execution via PDF or Office - Ousaban Pattern
id: c3d4e5f6-7890-12cd-ef34-567890123456
description: Detects VBS scripts spawned by PDF readers or Office applications, a common pattern in Ousaban phishing campaigns.
status: experimental
date: 2026/07/02
author: Security Arsenal
tags:
  - attack.initial_access
  - attack.t1566.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\AcroRd32.exe'
      - '\winword.exe'
      - '\excel.exe'
    Image|endswith:
      - '\wscript.exe'
      - '\cscript.exe'
  condition: selection
falsepositives:
  - Legitimate macro usage
level: high

// Hunt for network connections to known C2 IPs and suspicious domains
let IoC_IPs = pack_array("172.96.137.160", "162.33.179.46", "91.92.240.140", "78.40.209.32");
let IoC_Domains = pack_array("angryipscanner.org", "opmanager.pro", "rsat.activedirectory.ds-lds.tools");
DeviceNetworkEvents
| where RemoteIP in (IoC_IPs) or RemoteUrl has_any (IoC_Domains)
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteIP, RemoteUrl, RemotePort
| extend IoC_Type = iff(RemoteIP in (IoC_IPs), "IP_Address", "Domain")

# IOC Hunt Script for Bumblebee and Ousaban Activity
# Checks for network connections and file presence

$MaliciousIPs = @("172.96.137.160", "162.33.179.46", "91.92.240.140", "78.40.209.32")
$MaliciousHashes = @(
    "a14506c6fb92a5af88a6a44d273edafe10d69ee3d85c8b2a7ac458a22edf68d2", 
    "d4eb4ff02df659fdeec17d36b77084627469623bb3c7d16383d257404b52d1c3"
)

# Check Active Network Connections
Write-Host "Checking for active connections to malicious IPs..."
Get-NetTCPConnection -State Established | ForEach-Object {
    $ip = $_.RemoteAddress
    if ($MaliciousIPs -contains $ip) {
        Write-Host "WARNING: Suspicious connection found to $ip (PID: $($_.OwningProcess))" -ForegroundColor Red
        Get-Process -Id $_.OwningProcess | Select-Object ProcessName, Path
    }
}

# Check Common Download Directories for Malicious Files
Write-Host "Scanning user downloads for malicious hashes..."
$Paths = @("C:\Users\*\Downloads", "C:\Windows\Temp")
foreach ($path in $Paths) {
    if (Test-Path $path) {
        Get-ChildItem -Path $path -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
            $hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($MaliciousHashes -contains $hash) {
                Write-Host "WARNING: Malicious file found at $($_.FullName)" -ForegroundColor Red
            }
        }
    }
}