Bumblebee→Akira SEO Poisoning, The Gentlemen RaaS Surge & JINX-0164 Crypto Supply Chain Attacks: OTX Pulse Intelligence Briefing

---
title: Bumblebee Loader via Trojanized IT Management Tool Installer
id: 7a3c1f2e-8b4d-4e6a-9c5f-1d2e3f4a5b6c
status: experimental
description: Detects execution of Bumblebee loader delivered through trojanized installers for IT management tools via SEO poisoning, followed by credential dumping and RustDesk deployment
date: 2026/06/30
author: Security Arsenal
references:
    - https://thedfirreport.com/2025/08/05/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-2/
tags:
    - attack.execution
    - attack.t1059
    - attack.t1105
    - attack.t1027
    - attack.credential_access
    - attack.t1003
logsource:
    product: windows
    category: process_creation
detection:
    selection_trojanized_installer:
        Image|endswith:
            - '\\rundll32.exe'
            - '\\regsvr32.exe'
            - '\\msiexec.exe'
        CommandLine|contains:
            - 'opmanager'
            - 'angryipscanner'
            - '\\Temp\\'
            - '\\Downloads\\'
    selection_rustdesk:
        Image|endswith:
            - '\\rustdesk.exe'
        CommandLine|contains:
            - '--password'
            - '--connect'
            - '--get-id'
    selection_credential_dump:
        Image|endswith:
            - '\\procdump.exe'
            - '\\mimikatz.exe'
        CommandLine|contains:
            - 'lsass'
            - '-ma'
            - 'dump'
    selection_adaptixc2:
        CommandLine|contains:
            - 'AdaptixC2'
            - 'adaptix'
    filter_legitimate_paths:
        Image|startswith:
            - 'C:\\Program Files\\ManageEngine\\'
            - 'C:\\Program Files (x86)\\ManageEngine\\'
    condition: (selection_trojanized_installer or selection_rustdesk or selection_credential_dump or selection_adaptixc2) and not filter_legitimate_paths
falsepositives:
    - Legitimate IT management tool installation from verified vendor sources
    - Authorized RustDesk remote support sessions
level: high
---
title: The Gentlemen RaaS - GPO Deployment and Network Traffic Capture
id: 8b4d2f3e-9c5e-4f7b-ad6f-2e3f4a5b6c7d
status: experimental
description: Detects GPO-based malicious payload deployment, netsh packet capture, and reconnaissance tooling associated with The Gentlemen ransomware-as-a-service operations
date: 2026/06/30
author: Security Arsenal
references:
    - https://securelist.com/the-gentlemen-raas/120447/
tags:
    - attack.lateral_movement
    - attack.discovery
    - attack.t1046
    - attack.t1049
    - attack.t1486
    - attack.t1210
logsource:
    product: windows
    category: process_creation
detection:
    selection_gpo_deployment:
        Image|endswith:
            - '\\schtasks.exe'
            - '\\powershell.exe'
            - '\\cmd.exe'
        CommandLine|contains:
            - '\\SYSVOL\\'
            - '\\NETLOGON\\'
            - 'schtasks /create'
    selection_netsh_capture:
        Image|endswith: '\\netsh.exe'
        CommandLine|contains:
            - 'trace'
            - 'capture'
            - 'start'
    selection_recon_tools:
        Image|endswith:
            - '\\SharpADWS.exe'
            - '\\netscan.exe'
            - '\\advanced_ip_scanner.exe'
    selection_cobalt_strike:
        CommandLine|contains:
            - '-nop -w hidden'
            - 'IEX('
            - 'DownloadString'
            - 'sqroot'
    selection_rsat_abuse:
        CommandLine|contains:
            - 'rsat.activedirectory.ds-lds.tools'
    condition: selection_gpo_deployment or selection_netsh_capture or selection_recon_tools or selection_cobalt_strike or selection_rsat_abuse
falsepositives:
    - Legitimate network diagnostic activities by authorized IT staff
    - Authorized GPO deployments by domain administrators during maintenance windows
level: high
---
title: JINX-0164 AUDIOFIX and MINIRAT macOS Implant Activity
id: 9c5e3g4f-ad6f-4g8c-be7f-3f4a5b6c7d8e
status: experimental
description: Detects execution of AUDIOFIX Python infostealer/RAT and MINIRAT Go backdoor deployed via LinkedIn social engineering and npm trojan packages targeting cryptocurrency developers
date: 2026/06/30
author: Security Arsenal
references:
    - https://www.wiz.io/blog/threat-actors-target-crypto-orgs
tags:
    - attack.execution
    - attack.t1059.006
    - attack.t1059.004
    - attack.t1566.003
    - attack.persistence
    - attack.t1543.001
logsource:
    product: macos
    category: process_creation
detection:
    selection_audiofix:
        Image|endswith:
            - '/python3'
            - '/python'
        CommandLine|contains:
            - 'audiofix'
            - 'install.sh'
            - 'troubleshoot'
    selection_minirat:
        Image|endswith:
            - '/sh'
            - '/bash'
            - '/zsh'
        CommandLine|contains:
            - 'minirat'
            - 'driver-updater'
    selection_npm_trojan:
        Image|endswith:
            - '/npm'
            - '/node'
        CommandLine|contains:
            - 'teamicrosoft'
            - 'live.us.org'
            - 'live.ong'
    selection_curl_download:
        Image|endswith:
            - '/curl'
            - '/wget'
        CommandLine|contains:
            - '89.36.224.5'
            - 'driver-updater.net'
            - 'troubleshoot/mac/install.sh'
    selection_launchagent:
        CommandLine|contains:
            - 'LaunchAgents'
            - 'LaunchDaemons'
            - 'com.audiofix'
            - 'com.minirat'
    condition: selection_audiofix or selection_minirat or selection_npm_trojan or selection_curl_download or selection_launchagent
falsepositives:
    - Legitimate Python development activities with similarly named scripts
    - Authorized npm package installations from verified registries
level: high

// Security Arsenal - Multi-Campaign IOC Hunt (Bumblebee/Akira + The Gentlemen + JINX-0164)
// Hunt across network events, process events, and file events for known IOCs and behaviors
let ThreatIOC_IPs = dynamic(["172.96.137.160", "89.36.224.5"]);
let ThreatIOC_Domains = dynamic(["angryipscanner.org", "opmanager.pro", "driver-updater.net", "live.ong"]);
let ThreatIOC_Hostnames = dynamic(["login.teamicrosoft.com", "teams.live.us.org", "www.driver-updater.net", "www.live.us.org", "rsat.activedirectory.ds-lds.tools"]);
let ThreatIOC_URLs = dynamic(["http://89.36.224.5/troubleshoot/mac/install.sh"]);
let ThreatIOC_Hashes = dynamic(["a14506c6fb92a5af88a6a44d273edafe10d69ee3d85c8b2a7ac458a22edf68d2", "f8965fdce668692c3785afa3559159f9a18287bc0d53abb21902895a8ecf221b", "5af1dae21425dda8311a2044209c308525135e1733eeff5dd20649946c6e054c", "b6cab0b3aa8e56e2427f486c74588d598ae58bb0cbc0eda6939fe171cb0aed17"]);
let ThreatIOC_BehaviorCmds = dynamic(["opmanager", "angryipscanner", "audiofix", "minirat", "driver-updater", "teamicrosoft", "AdaptixC2", "rustdesk", "SharpADWS", "netscan", "netsh trace", "SYSVOL"]);
union 
(
    DeviceNetworkEvents
    | where RemoteIP in (ThreatIOC_IPs)
        or RemoteUrl has_any (ThreatIOC_Domains)
        or RemoteUrl has_any (ThreatIOC_Hostnames)
        or RemoteUrl has_any (ThreatIOC_URLs)
        or RemoteDomain has_any (ThreatIOC_Domains)
        or RemoteDomain has_any (ThreatIOC_Hostnames)
    | extend MatchType = "Network IOC", MatchValue = strcat(RemoteIP, " | ", RemoteUrl, " | ", RemoteDomain)
    | project TimeGenerated, DeviceName, MatchType, MatchValue, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemotePort
),
(
    DeviceProcessEvents
    | where ProcessCommandLine has_any (ThreatIOC_BehaviorCmds)
        or InitiatingProcessCommandLine has_any (ThreatIOC_BehaviorCmds)
        or SHA256 in (ThreatIOC_Hashes)
        or InitiatingProcessSHA256 in (ThreatIOC_Hashes)
    | extend MatchType = "Process IOC/Behavior", MatchValue = strcat(FileName, " | ", ProcessCommandLine)
    | project TimeGenerated, DeviceName, MatchType, MatchValue, FileName, ProcessCommandLine, AccountName, SHA256
),
(
    DeviceFileEvents
    | where SHA256 in (ThreatIOC_Hashes)
        or FileName in~ ("rustdesk.exe", "SharpADWS.exe", "audiofix", "minirat", "install.sh")
    | extend MatchType = "File IOC", MatchValue = strcat(FileName, " | ", FolderPath, " | ", SHA256)
    | project TimeGenerated, DeviceName, MatchType, MatchValue, FileName, FolderPath, SHA256, InitiatingProcessFileName
)
| sort by TimeGenerated desc

<#
.SYNOPSIS
    Security Arsenal IOC Hunt - Bumblebee/Akira, The Gentlemen RaaS, JINX-0164
.DESCRIPTION
    Checks for network connections, DNS cache, file hashes, scheduled tasks,
    registry persistence, and process artifacts associated with three active
    OTX-sourced threat campaigns targeting enterprise and developer infrastructure.
#>

$C2_IPs = @("172.96.137.160", "89.36.224.5")
$C2_Domains = @("angryipscanner.org", "opmanager.pro", "driver-updater.net", "live.ong")
$C2_Hostnames = @("login.teamicrosoft.com", "teams.live.us.org", "www.driver-updater.net", "www.live.us.org", "rsat.activedirectory.ds-lds.tools")
$MaliciousHashes = @(
    "a14506c6fb92a5af88a6a44d273edafe10d69ee3d85c8b2a7ac458a22edf68d2",
    "a746da514c90f26a187a294fda7edc1b",
    "bcee0ab10b23f5999bcdb56c0b4a631a",
    "f8965fdce668692c3785afa3559159f9a18287bc0d53abb21902895a8ecf221b",
    "5af1dae21425dda8311a2044209c308525135e1733eeff5dd20649946c6e054c",
    "b6b51508ad6f462c45fe102c85d246c8",
    "b6cab0b3aa8e56e2427f486c74588d598ae58bb0cbc0eda6939fe171cb0aed17"
)
$SuspiciousProcesses = @("rustdesk", "SharpADWS", "netscan", "advanced_ip_scanner", "audiofix", "minirat")
$SuspiciousPaths = @(
    "$env:TEMP\opmanager", "$env:TEMP\angryipscanner", "$env:TEMP\troubleshoot",
    "$env:APPDATA\AudioFix", "$env:APPDATA\MiniRat", "$env:APPDATA\driver-updater"
)

Write-Host "`n[*] Security Arsenal IOC Hunt - 3 Campaign Sweep" -ForegroundColor Cyan
Write-Host "[*] Started: $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')`n" -ForegroundColor Yellow

# 1. Active TCP connections to C2 IPs
Write-Host "[1/7] Checking active network connections to C2 IPs..." -ForegroundColor Green
$conns = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | Where-Object { $_.RemoteAddress -in $C2_IPs }
if ($conns) { $conns | ForEach-Object { Write-Host "  [!] C2 CONNECTION: $($_.RemoteAddress):$($_.RemotePort) PID:$($_.OwningProcess)" -ForegroundColor Red } }
else { Write-Host "  [-] No active C2 connections.`n" -ForegroundColor Gray }

# 2. DNS cache for malicious domains
Write-Host "[2/7] Checking DNS resolver cache..." -ForegroundColor Green
$dns = Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object { $_.Entry -in $C2_Domains -or $_.Entry -in $C2_Hostnames }
if ($dns) { $dns | ForEach-Object { Write-Host "  [!] DNS CACHE HIT: $($_.Entry) -> $($_.Data)" -ForegroundColor Red } }
else { Write-Host "  [-] No malicious DNS entries.`n" -ForegroundColor Gray }

# 3. Files matching malicious hashes
Write-Host "[3/7] Scanning suspicious paths for malicious file hashes..." -ForegroundColor Green
$found = $false
foreach ($p in $SuspiciousPaths) {
    if (Test-Path $p) {
        Get-ChildItem -Path $p -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
            $h256 = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            $hmd5 = (Get-FileHash -Path $_.FullName -Algorithm MD5 -ErrorAction SilentlyContinue).Hash
            if ($h256 -in $MaliciousHashes -or $hmd5 -in $MaliciousHashes) {
                Write-Host "  [!] MALICIOUS FILE: $($_.FullName) SHA256:$h256" -ForegroundColor Red
                $found = $true
            }
        }
    }
}
if (-not $found) { Write-Host "  [-] No files matching malicious hashes.`n" -ForegroundColor Gray }

# 4. Scheduled tasks for persistence
Write-Host "[4/7] Checking scheduled tasks for persistence..." -ForegroundColor Green
$tasks = Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object { $_.TaskName -match "audiofix|minirat|opmanager|troubleshoot|driver.?update|adaptix" -and $_.State -ne "Disabled" }
if ($tasks) { $tasks | ForEach-Object { Write-Host "  [!] SUSPICIOUS TASK: $($_.TaskName) at $($_.TaskPath)" -ForegroundColor Red } }
else { Write-Host "  [-] No suspicious scheduled tasks.`n" -ForegroundColor Gray }

# 5. Running suspicious processes
Write-Host "[5/7] Checking running processes..." -ForegroundColor Green
$procs = Get-Process -ErrorAction SilentlyContinue | Where-Object { $_.ProcessName -in $SuspiciousProcesses }
if ($procs) { $procs | ForEach-Object { Write-Host "  [!] SUSPICIOUS PROCESS: $($_.ProcessName) PID:$($_.Id)" -ForegroundColor Red } }
else { Write-Host "  [-] No suspicious processes running.`n" -ForegroundColor Gray }

# 6. Registry persistence keys
Write-Host "[6/7] Checking registry Run keys for persistence..." -ForegroundColor Green
$regPaths = @("HKCU:\Software\Microsoft\Windows\CurrentVersion\Run", "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run", "HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce")
$regFound = $false
foreach ($rp in $regPaths) {
    $props = Get-ItemProperty -Path $rp -ErrorAction SilentlyContinue
    if ($props) {
        $props.PSObject.Properties | Where-Object { $_.Value -match "audiofix|minirat|rustdesk|opmanager|troubleshoot|driver-updater|adaptix" } | ForEach-Object {
            Write-Host "  [!] REGISTRY PERSISTENCE: $($_.Name)=$($_.Value) in $rp" -ForegroundColor Red
            $regFound = $true
        }
    }
}
if (-not $regFound) { Write-Host "  [-] No suspicious registry entries.`n" -ForegroundColor Gray }

# 7. netsh packet capture (The Gentlemen)
Write-Host "[7/7] Checking for netsh packet capture activity..." -ForegroundColor Green
$netsh = Get-WmiObject Win32_Process -ErrorAction SilentlyContinue | Where-Object { $_.Name -eq "netsh.exe" -and $_.CommandLine -match "trace|capture" }
if ($netsh) { $netsh | ForEach-Object { Write-Host "  [!] NETSH CAPTURE: $($_.CommandLine)" -ForegroundColor Red } }
else { Write-Host "  [-] No netsh capture detected.`n" -ForegroundColor Gray }

Write-Host "[*] Hunt Complete: $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')" -ForegroundColor Cyan
Write-Host "[*] Escalate any [!] findings to IR immediately.`n" -ForegroundColor Yellow


---