Bumblebee→Akira, KimJongRAT & Djinn Stealer: OTX Pulse Analysis — Multi-Vector Credential Theft Detection Pack

---
title: Bumblebee Loader SEO Poisoning - Trojanized IT Tool Installer Execution
id: 7a3c1f2e-8b4d-4e6a-9c5d-1f2e3a4b5c6d
status: experimental
description: Detects Bumblebee malware execution from trojanized IT management tool installers delivered via SEO poisoning campaigns
references:
    - https://thedfirreport.com/2025/08/05/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-2/
author: Security Arsenal Threat Intelligence
date: 2026/06/30
tags:
    - attack.execution
    - attack.initial_access
    - attack.t1204.002
    - attack.t1185
logsource:
    product: windows
    category: process_creation
detection:
    selection_installer:
        Image|endswith:
            - '\\opmanager_pro.exe'
            - '\\angryipscanner_setup.exe'
            - '\\ManageEngine_OpManager.exe'
        CommandLine|contains:
            - 'opmanager.pro'
            - 'angryipscanner.org'
    selection_bumblebee_network:
        Image|endswith:
            - '\\rundll32.exe'
            - '\\regsvr32.exe'
            - '\\mshta.exe'
        CommandLine|contains:
            - '172.96.137.160'
    selection_rustdesk_abuse:
        Image|endswith: '\\rustdesk.exe'
        ParentImage|endswith:
            - '\\cmd.exe'
            - '\\powershell.exe'
            - '\\mshta.exe'
    condition: selection_installer or selection_bumblebee_network or selection_rustdesk_abuse
falsepositives:
    - Legitimate RustDesk usage from interactive sessions (verify parent process)
    - Legitimate ManageEngine OpManager installation from verified vendor source
level: high

---
title: TaskWeaver Node.js Loader - C2 via Dev Tunnels
id: 8b4d2f3e-9c5e-4f7b-0d6e-2a3f4b5c6d7e
status: experimental
description: Detects TaskWeaver Node.js loader execution and Djinn Stealer C2 communication through Azure dev-tunnels following SimpleHelp exploitation
references:
    - https://blackpointcyber.com/blog/a-djinn-in-the-machine-taskweavers-node-js-intrusion-chain/
author: Security Arsenal Threat Intelligence
date: 2026/06/30
tags:
    - attack.execution
    - attack.t1059.007
    - attack.t1219
    - attack.command_and_control
logsource:
    product: windows
    category: process_creation
detection:
    selection_nodejs_simplehelp:
        Image|endswith: '\\node.exe'
        ParentImage|contains:
            - 'simplehelp'
            - 'SimpleHelp'
    selection_devtunnels_c2:
        Image|endswith:
            - '\\node.exe'
            - '\\powershell.exe'
            - '\\curl.exe'
        CommandLine|contains:
            - 'a.dev-tunnels.com'
            - '96.126.130.126'
    selection_djinn_hash:
        Hashes|contains:
            - '00cc86d1144020c24c8fbb3a8dc6b908926497ebd23be3bf854360f93d1c8f4c'
            - 'f4a72600a3735c2a4d843875ea61bbb6f935a1af51a81f2fbc992ce11ba94afc'
    condition: selection_nodejs_simplehelp or selection_devtunnels_c2 or selection_djinn_hash
falsepositives:
    - Legitimate Node.js development using Azure dev-tunnels (verify SimpleHelp parent process)
level: high

---
title: KimJongRAT Distribution via GitHub Releases and MeshAgent Persistence
id: 9c5e3a4f-0d6f-4a8c-1e7f-3b4a5c6d7e8f
status: experimental
description: Detects KimJongRAT execution from GitHub-distributed ZIP archives and MeshAgent persistence used by Kimsuky APT group
references:
    - https://sect.iij.ad.jp/blog/2026/06/continuous-evolution-of-kimjongrat-2026/
author: Security Arsenal Threat Intelligence
date: 2026/06/30
tags:
    - attack.execution
    - attack.persistence
    - attack.t1059.001
    - attack.command_and_control
    - attack.t1071.001
logsource:
    product: windows
    category: process_creation
detection:
    selection_github_zip_exec:
        Image|endswith:
            - '\\powershell.exe'
            - '\\wscript.exe'
            - '\\mshta.exe'
        CommandLine|contains:
            - 'github.com'
            - 'githubusercontent.com'
            - 'servequake.com'
            - 'corpsecs.com'
    selection_kimjongrat_c2:
        CommandLine|contains:
            - 'googleoba.servequake.com:8443'
            - 'lutkdd.corpsecs.com'
            - 'pxqtkc.corpsecs.com'
            - '104.200.67.46'
    selection_meshagent_persistence:
        Image|endswith: '\\meshagent.exe'
        CommandLine|contains:
            - '--baseURL'
            - 'servequake.com'
            - 'corpsecs.com'
    selection_kimjongrat_hash:
        Hashes|contains:
            - '9758e76b601798a30d903bf05052a53df80451e5c156548ce9da828f608b6470'
            - '221a39856b37e3c682f62427f1e6b965b36a2405764689c914672770a01a1fa9'
    condition: selection_github_zip_exec or selection_kimjongrat_c2 or selection_meshagent_persistence or selection_kimjongrat_hash
falsepositives:
    - Legitimate MeshAgent deployments (verify C2 domain should be MeshCentral, not servequake.com or corpsecs.com)
    - Legitimate GitHub release downloads (correlate with user activity and verify subsequent execution)
level: critical

// Multi-pulse IOC hunt: Bumblebee, TaskWeaver/Djinn, KimJongRAT, JINX-0164, Langflow exploitation
let ioc_ips = dynamic(["172.96.137.160", "96.126.130.126", "104.200.67.46", "45.207.216.55", "89.36.224.5"]);
let ioc_domains = dynamic(["opmanager.pro", "angryipscanner.org", "a.dev-tunnels.com", "lutkdd.corpsecs.com", "pxqtkc.corpsecs.com", "googleoba.servequake.com", "login.teamicrosoft.com", "driver-updater.net", "live.ong", "live.us.org"]);
let ioc_hashes = dynamic(["a14506c6fb92a5af88a6a44d273edafe10d69ee3d85c8b2a7ac458a22edf68d2", "00cc86d1144020c24c8fbb3a8dc6b908926497ebd23be3bf854360f93d1c8f4c", "f4a72600a3735c2a4d843875ea61bbb6f935a1af51a81f2fbc992ce11ba94afc", "b6cab0b3aa8e56e2427f486c74588d598ae58bb0cbc0eda6939fe171cb0aed17", "9758e76b601798a30d903bf05052a53df80451e5c156548ce9da828f608b6470", "221a39856b37e3c682f62427f1e6b965b36a2405764689c914672770a01a1fa9"]);
let ioc_urls = dynamic(["http://89.36.224.5/troubleshoot/mac/install.sh", "http://googleoba.servequake.com:8443/agent.ashx", "http://45.207.216.55:8084/slt", "https://lutkdd.corpsecs.com"]);
union
DeviceNetworkEvents
| where RemoteIP in (ioc_ips) or RemoteUrl has_any (ioc_urls) or RemoteUrl has_any (ioc_domains)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteIP, RemoteUrl, RemotePort, ActionType,
  PulseRelated = case(
    RemoteIP == "172.96.137.160" or RemoteUrl has "opmanager.pro" or RemoteUrl has "angryipscanner.org", "Bumblebee/Akira",
    RemoteIP == "96.126.130.126" or RemoteUrl has "dev-tunnels.com", "TaskWeaver/Djinn Stealer",
    RemoteIP == "104.200.67.46" or RemoteUrl has "corpsecs.com" or RemoteUrl has "servequake.com", "KimJongRAT/Kimsuky",
    RemoteIP == "89.36.224.5", "JINX-0164/AUDIOFIX",
    RemoteIP == "45.207.216.55", "Langflow Exploitation",
    "Unknown"
  ),
DeviceProcessEvents
| where InitiatingProcessSHA256 in (ioc_hashes) or SHA256 in (ioc_hashes)
| project TimeGenerated, DeviceName, FileName, FolderPath, ProcessCommandLine, SHA256, InitiatingProcessFileName,
  PulseRelated = "IOC Hash Match"
,
DeviceProcessEvents
| where FileName =~ "node.exe" and (InitiatingProcessFileName has "simplehelp" or InitiatingProcessFileName has "SimpleHelp")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName,
  PulseRelated = "TaskWeaver via SimpleHelp Exploit"
,
DeviceProcessEvents
| where FileName =~ "meshagent.exe" and ProcessCommandLine has_any (dynamic(["servequake.com", "corpsecs.com", "104.200.67.46"]))
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine,
  PulseRelated = "KimJongRAT MeshAgent C2"
,
DeviceProcessEvents
| where FileName =~ "rustdesk.exe" and InitiatingProcessFileName in (dynamic(["cmd.exe", "powershell.exe", "mshta.exe"]))
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName,
  PulseRelated = "Bumblebee RustDesk Lateral Movement"

<#
.SYNOPSIS
    Multi-pulse IOC hunt script targeting Bumblebee, TaskWeaver/Djinn Stealer, KimJongRAT, AUDIOFIX/MINIRAT, and Langflow exploitation.
.DESCRIPTION
    Checks for network connections, file hashes, suspicious processes, scheduled tasks, and registry persistence
    associated with OTX pulse IOCs from 2026-06-25 to 2026-06-30.
.NOTES
    Run with elevated privileges. Designed for enterprise SOC hunt operations.
#>

$IOC_IPs = @(
    "172.96.137.160",
    "96.126.130.126",
    "104.200.67.46",
    "45.207.216.55",
    "89.36.224.5"
)

$IOC_Domains = @(
    "opmanager.pro",
    "angryipscanner.org",
    "a.dev-tunnels.com",
    "lutkdd.corpsecs.com",
    "pxqtkc.corpsecs.com",
    "googleoba.servequake.com",
    "login.teamicrosoft.com",
    "www.driver-updater.net",
    "live.ong",
    "www.live.us.org"
)

$IOC_Hashes = @{
    "a14506c6fb92a5af88a6a44d273edafe10d69ee3d85c8b2a7ac458a22edf68d2" = "Bumblebee Loader (SHA256)"
    "a746da514c90f26a187a294fda7edc1b" = "Bumblebee Loader (MD5)"
    "bcee0ab10b23f5999bcdb56c0b4a631a" = "Bumblebee Loader (MD5)"
    "00cc86d1144020c24c8fbb3a8dc6b908926497ebd23be3bf854360f93d1c8f4c" = "TaskWeaver Node.js Loader (SHA256)"
    "f4a72600a3735c2a4d843875ea61bbb6f935a1af51a81f2fbc992ce11ba94afc" = "Djinn Stealer (SHA256)"
    "b6cab0b3aa8e56e2427f486c74588d598ae58bb0cbc0eda6939fe171cb0aed17" = "AUDIOFIX/MINIRAT (SHA256)"
    "9758e76b601798a30d903bf05052a53df80451e5c156548ce9da828f608b6470" = "KimJongRAT (SHA256)"
    "221a39856b37e3c682f62427f1e6b965b36a2405764689c914672770a01a1fa9" = "KimJongRAT Component (SHA256)"
}

Write-Host "`n=== OTX Pulse IOC Hunt - $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss') ===`n" -ForegroundColor Cyan

# 1. Check active network connections to IOC IPs
Write-Host "[1/6] Checking active network connections to IOC IPs..." -ForegroundColor Yellow
$activeConnections = Get-NetTCPConnection -State Established, SynSent, SynReceived -ErrorAction SilentlyContinue |
    Where-Object { $IOC_IPs -contains $_.RemoteAddress }
if ($activeConnections) {
    Write-Host "  [!] ACTIVE CONNECTIONS TO IOC IPs:" -ForegroundColor Red
    foreach ($conn in $activeConnections) {
        $proc = Get-Process -Id $conn.OwningProcess -ErrorAction SilentlyContinue
        Write-Host "    PID: $($conn.OwningProcess) | Process: $($proc.ProcessName) | Remote: $($conn.RemoteAddress):$($conn.RemotePort) | State: $($conn.State)" -ForegroundColor Red
    }
} else {
    Write-Host "  [OK] No active connections to IOC IPs found." -ForegroundColor Green
}

# 2. Check DNS cache for IOC domains
Write-Host "`n[2/6] Checking DNS cache for IOC domains..." -ForegroundColor Yellow
$dnsCache = Get-DnsClientCache -ErrorAction SilentlyContinue |
    Where-Object { $IOC_Domains -contains $_.Entry }
if ($dnsCache) {
    Write-Host "  [!] DNS CACHE HITS FOR IOC DOMAINS:" -ForegroundColor Red
    foreach ($entry in $dnsCache) {
        Write-Host "    Domain: $($entry.Entry) | Type: $($entry.Type) | Data: $($entry.Data)" -ForegroundColor Red
    }
} else {
    Write-Host "  [OK] No DNS cache hits for IOC domains." -ForegroundColor Green
}

# 3. Check running processes against IOC hashes
Write-Host "`n[3/6] Checking running processes for IOC hashes..." -ForegroundColor Yellow
$processes = Get-Process -ErrorAction SilentlyContinue
$hashHits = @()
foreach ($proc in $processes) {
    try {
        $path = $proc.Path
        if ($path -and (Test-Path $path)) {
            $sha256 = (Get-FileHash -Path $path -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            $md5 = (Get-FileHash -Path $path -Algorithm MD5 -ErrorAction SilentlyContinue).Hash
            if ($IOC_Hashes.ContainsKey($sha256) -or $IOC_Hashes.ContainsKey($md5)) {
                $hashHits += [PSCustomObject]@{
                    Process = $proc.ProcessName
                    PID = $proc.Id
                    Path = $path
                    HashMatch = if ($IOC_Hashes.ContainsKey($sha256)) { $IOC_Hashes[$sha256] } else { $IOC_Hashes[$md5] }
                }
            }
        }
    } catch {}
}
if ($hashHits) {
    Write-Host "  [!] IOC HASH MATCHES IN RUNNING PROCESSES:" -ForegroundColor Red
    $hashHits | Format-Table -AutoSize
} else {
    Write-Host "  [OK] No running processes matching IOC hashes." -ForegroundColor Green
}

# 4. Check scheduled tasks for persistence mechanisms
Write-Host "`n[4/6] Checking scheduled tasks for suspicious persistence..." -ForegroundColor Yellow
$suspiciousTasks = Get-ScheduledTask -ErrorAction SilentlyContinue |
    Where-Object {
        $_.Actions.Execute -match "meshagent|rustdesk|node" -or
        $_.Actions.Arguments -match "corpsecs|servequake|dev-tunnels|opmanager|angryipscanner|simplehelp"
    }
if ($suspiciousTasks) {
    Write-Host "  [!] SUSPICIOUS SCHEDULED TASKS DETECTED:" -ForegroundColor Red
    foreach ($task in $suspiciousTasks) {
        Write-Host "    Task: $($task.TaskName) | Path: $($task.TaskPath) | State: $($task.State)" -ForegroundColor Red
        foreach ($action in $task.Actions) {
            Write-Host "      Execute: $($action.Execute) | Args: $($action.Arguments)" -ForegroundColor Red
        }
    }
} else {
    Write-Host "  [OK] No suspicious scheduled tasks found." -ForegroundColor Green
}

# 5. Check registry for persistence
Write-Host "`n[5/6] Checking registry persistence mechanisms..." -ForegroundColor Yellow
$regPaths = @(
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce",
    "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
    "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce",
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Winlogon"
)
$regHits = @()
foreach ($regPath in $regPaths) {
    if (Test-Path $regPath) {
        $props = Get-ItemProperty -Path $regPath -ErrorAction SilentlyContinue
        if ($props) {
            $props.PSObject.Properties | ForEach-Object {
                if ($_.Value -match "meshagent|rustdesk|node|corpsecs|servequake|dev-tunnels|opmanager|simplehelp") {
                    $regHits += [PSCustomObject]@{
                        RegPath = $regPath
                        Name = $_.Name
                        Value = $_.Value
                    }
                }
            }
        }
    }
}
if ($regHits) {
    Write-Host "  [!] SUSPICIOUS REGISTRY PERSISTANCE DETECTED:" -ForegroundColor Red
    $regHits | Format-Table -AutoSize
} else {
    Write-Host "  [OK] No suspicious registry persistence found." -ForegroundColor Green
}

# 6. Check for SimpleHelp exploitation artifacts
Write-Host "`n[6/6] Checking for SimpleHelp exploitation artifacts (CVE-2026-48558)..." -ForegroundColor Yellow
$simpleHelpPaths = @(
    "C:\Program Files\SimpleHelp",
    "C:\Program Files (x86)\SimpleHelp",
    "C:\SimpleHelp"
)
$simpleHelpFound = $false
foreach ($shPath in $simpleHelpPaths) {
    if (Test-Path $shPath) {
        $simpleHelpFound = $true
        Write-Host "  [!] SIMPLEHELP INSTALLATION DETECTED at $shPath" -ForegroundColor Red
        Write-Host "      Verify CVE-2026-48558 patch status immediately." -ForegroundColor Red
        $logPath = Join-Path $shPath "logs"
        if (Test-Path $logPath) {
            $recentLogs = Get-ChildItem $logPath -Filter "*.log" -ErrorAction SilentlyContinue |
                Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-30) }
            if ($recentLogs) {
                Write-Host "      Recent log files found - review for unauthorized access:" -ForegroundColor Yellow
                $recentLogs | ForEach-Object { Write-Host "        $($_.Name) - Last modified: $($_.LastWriteTime)" }
            }
        }
    }
}
if (-not $simpleHelpFound) {
    Write-Host "  [OK] No SimpleHelp installation detected on this host." -ForegroundColor Green
}

# Summary
Write-Host "`n=== HUNT SUMMARY ===" -ForegroundColor Cyan
Write-Host "Host: $env:COMPUTERNAME" -ForegroundColor White
Write-Host "Timestamp: $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')" -ForegroundColor White
Write-Host "IOCs Checked: $($IOC_IPs.Count) IPs, $($IOC_Domains.Count) domains, $($IOC_Hashes.Count) hashes" -ForegroundColor White
Write-Host "Results: $($activeConnections.Count) active connections, $($hashHits.Count) hash matches, $($suspiciousTasks.Count) suspicious tasks, $($regHits.Count) registry hits" -ForegroundColor White
if ($hashHits -or $activeConnections -or $suspiciousTasks -or $regHits) {
    Write-Host "`n[CRITICAL] Positive detections found - initiate incident response procedures." -ForegroundColor Red
} else {
    Write-Host "`n[INFO] No positive detections on this host." -ForegroundColor Green
}
Write-Host "`n=== END HUNT ===`n" -ForegroundColor Cyan


---