Three AlienVault OTX pulses published 2026-09-16 collectively paint a picture of the modern intrusion ecosystem: commoditized initial access, abused legitimate infrastructure for command-and-control, and state-nexus espionage tooling converging on the same evasion playbook.
Pulse 1 — C2Looper. Zscaler's research into C2Looper reveals a Rust-based backdoor assessed with low-to-medium confidence to be delivered via multi-stage ClickFix social-engineering chains — the same delivery mechanism that has powered Oyster (aka Broomstick/CleanUpLoader) and Lactrodectus (Latrodectus) loaders for initial access brokers feeding ransomware affiliates. C2Looper's distinguishing feature is its use of GitHub as dead-drop/C2 infrastructure, blending malicious traffic with legitimate developer workflows, and its use of DLL sideloading for execution. The ransomware linkage means a C2Looper detection should be treated as a pre-ransomware event.
Pulse 2 — Mythic C2 at Internet scale. Censys identified 131 unique Internet-exposed hosts running the Mythic open-source C2 framework (agents including Apollo, Nyx, and fys2). While Mythic is a legitimate red-team platform, its presence on unmanaged VPS providers (DigitalOcean, GoDaddy, 1337 Services GmbH, bulletproof-adjacent ASNs) strongly correlates with criminal and APT reuse. Exposed Mythic panels are both an offensive indicator (active operator infrastructure) and a defensive opportunity (fingerprintable TLS/HTTP profiles).
Pulse 3 — Operation QUICSILVER. Seqrite attributes a China-nexus actor targeting Myanmar government personnel and diplomats. The chain delivers Virtual Hard Disk (VHD) files masquerading as JPEG images containing Burmese-language lures impersonating Myanmar's Information Technology and Cyber Security Department (fake graduation ceremony invitations). The final payload is QUICAgent, a Go-based backdoor communicating over the QUIC protocol (UDP/443) and leveraging Cloudflare Workers as C2 proxy infrastructure — classic infrastructure laundering through trusted SaaS.
Collective assessment: All three pulses share a strategic theme — adversaries are systematically moving C2 onto legitimate platforms (GitHub, Cloudflare) and non-standard transports (QUIC) while delivery relies on user-execution social engineering (ClickFix prompts, lure-embedded VHDs). Perimeter IP/domain blocking alone is insufficient; behavioral detection on process chains, protocol anomalies, and sideloading artifacts is required.
Threat Actor / Malware Profile
C2Looper (Rust backdoor — ransomware-affiliated)
- Distribution: Multi-stage ClickFix chains — victims are prompted to paste/execute malicious commands (typically PowerShell or
mshta.exe) presented as a "verification" or "fix." Consistent with Oyster/Lactrodectus IAB tradecraft. - Payload behavior: Remote shell execution, host reconnaissance, and staged deployment of additional payloads — an access-enablement backdoor, not an endgame payload.
- C2 communication: Abuses GitHub (repos/issues/raw content) as a dead-drop resolver and tasking channel. Expect HTTPS to
api.github.com,raw.githubusercontent.com, orgist.githubusercontent.comoriginating from non-browser, non-developer processes. - Persistence/execution: DLL sideloading against signed binaries; Rust compilation frustrates signature-based AV and complicates static reverse engineering.
- Anti-analysis: Dynamically resolves Windows APIs at runtime (no static import table for key functions), reducing IOC fidelity for sandboxes and EDR static engines.
Mythic C2 (adversary infrastructure)
- Platform: Open-source, plugin-based C2 with web operator UI; agents observed include Apollo, Nyx, and fys2.
- Infrastructure profile: 131 exposed hosts concentrated in commodity VPS and low-scrutiny hosting (AS14061 DigitalOcean, AS26496/AS398101 GoDaddy, AS210558 1337 Services GmbH). Default Mythic listeners expose fingerprintable HTTP/TLS behavior on operator-defined ports.
- Operational note: Presence of these IPs in proxy, DNS, or netflow logs from corporate endpoints = high-fidelity malicious signal; legitimate red-team use should be allowlisted by engagement, not globally.
QUICAgent / Operation QUICSILVER (China-nexus, espionage)
- Distribution: Spearphishing carrying VHD attachments disguised as JPEGs; mounting the VHD exposes lure content and a malicious launcher. Burmese-language social engineering impersonating a national IT/Cybersecurity department.
- Payload behavior: Go-compiled backdoor (QUICAgent) providing remote tasking against diplomatic/government targets; technology sector also in scope.
- C2 communication: QUIC over UDP/443 — bypasses TCP-only inspection and many TLS-proxy stacks — with Cloudflare Workers fronting the C2, giving traffic a clean reputation.
- Targeting: Myanmar government and diplomats; assessed espionage objective, consistent with regional China-nexus collection priorities.
IOC Analysis
The pulse indicator set spans three operational classes:
File hashes (SHA256/SHA1/MD5 — 11+ samples): C2Looper binaries and QUICSILVER VHD/Go payload artifacts. Hashes are perishable (Rust and Go recompile trivially), so treat them as hunting pivots rather than durable blocks. Enrich against your EDR's file reputation store and sweep historical telemetry for any host that has ever executed these hashes — dwell time matters for the espionage campaign.
IPv4 indicators (7 shown, 131 total in campaign): Mythic C2 hosts on VPS providers. These are network-block candidates with low false-positive risk for most enterprises (no business dependency on random GoDaddy/DigitalOcean droplets). Operationalize as:
- Egress firewall/proxy deny lists
- Retroactive netflow/proxy log sweeps (30–90 days)
- TLS inspection alerts for self-signed or mismatched certs on these IPs
No domain IOCs provided — by design. Both C2Looper and QUICAgent hide behind high-reputation domains (github.com, workers.dev). This means detection must shift to process-to-destination correlation: which process made the connection, not just where it went.
Tooling for operationalization:
- MISP / OpenCTI for IOC ingestion and decay scoring
- Censys/Shodan for proactive Mythic panel discovery on attacker-adjacent ASNs
- JA3/JA4 fingerprinting for Mythic and QUIC TLS anomalies
- Zeek/Suricata with QUIC visibility rules for UDP/443 non-browser flows
Detection Engineering
---
title: C2Looper ClickFix Execution and GitHub C2 Abuse
id: 8f3a1c2e-4b7d-4e9a-a1c5-c2l00per0001
status: experimental
description: Detects ClickFix-style user-pasted command execution spawning scripting interpreters, followed by non-browser HTTPS connections to GitHub API/raw endpoints consistent with C2Looper dead-drop C2.
author: Security Arsenal Threat Intelligence
logsource:
category: process_creation
product: windows
detection:
selection_clickfix_parents:
ParentImage|endswith:
- '\explorer.exe'
- '\msedge.exe'
- '\chrome.exe'
- '\firefox.exe'
selection_clickfix_images:
Image|endswith:
- '\powershell.exe'
- '\pwsh.exe'
- '\mshta.exe'
- '\wscript.exe'
- '\cscript.exe'
- '\rundll32.exe'
selection_suspicious_cmd:
CommandLine|contains:
- ' -enc '
- ' -ec '
- 'FromBase64String'
- 'IEX'
- 'Invoke-Expression'
- 'DownloadString'
- 'githubusercontent'
condition: selection_clickfix_parents and selection_clickfix_images and selection_suspicious_cmd
falsepositives:
- Developer workflows invoking PowerShell against GitHub APIs
- Legitimate IT automation scripts
level: high
tags:
- attack.execution
- attack.t1059
- attack.t1204
- attack.t1102
- attack.command_and_control
date: 2026/09/16
---
title: QUICSILVER VHD Mount and Masqueraded Attachment Execution
id: 9b4d2e1f-6c8a-4f2b-b3d6-qu1cs1lv0002
status: experimental
description: Detects mounting of Virtual Hard Disk files delivered as attachments or masquerading as images, and subsequent process execution from the mounted volume, consistent with Operation QUICSILVER delivery.
author: Security Arsenal Threat Intelligence
logsource:
category: process_creation
product: windows
detection:
selection_vhd_mount:
CommandLine|contains:
- '.vhd'
- '.vhdx'
Image|endswith:
- '\powershell.exe'
- '\diskpart.exe'
- '\mountvol.exe'
selection_double_ext:
CommandLine|contains:
- '.jpg.vhd'
- '.jpeg.vhd'
- '.png.vhd'
- '.jpg.exe'
- '.jpeg.exe'
selection_exec_from_mounted:
Image|startswith:
- 'E:\'
- 'F:\'
- 'G:\'
Image|endswith:
- '.exe'
- '.lnk'
- '.dll'
condition: 1 of selection_vhd_mount or 1 of selection_double_ext or 1 of selection_exec_from_mounted
falsepositives:
- IT provisioning workflows mounting VHD images
- Backup/recovery tooling
level: high
tags:
- attack.initial_access
- attack.t1566.001
- attack.t1036
- attack.t1204
date: 2026/09/16
---
title: QUIC C2 and Mythic Infrastructure Network Indicators
id: 7c2e9a4d-1f5b-4d8c-c4a7-myqu1cc20003
status: experimental
description: Detects UDP/443 QUIC flows from non-browser processes (QUICAgent tradecraft) and network connections to known exposed Mythic C2 hosts identified in OTX pulse data.
author: Security Arsenal Threat Intelligence
logsource:
category: network_connection
product: windows
detection:
selection_mythic_ips:
DestinationIp:
- '142.93.52.11'
- '65.87.7.11'
- '194.26.192.117'
- '68.178.205.17'
- '192.169.176.54'
- '68.178.202.150'
- '170.64.183.242'
selection_quic_udp:
DestinationPort: 443
Protocol: udp
filter_browsers:
Image|endswith:
- '\chrome.exe'
- '\msedge.exe'
- '\firefox.exe'
- '\brave.exe'
condition: selection_mythic_ips or (selection_quic_udp and not filter_browsers)
falsepositives:
- Go-based legitimate applications using QUIC (rare on endpoints)
- VPN and tunneling clients
level: critical
tags:
- attack.command_and_control
- attack.t1071
- attack.t1572
- attack.t1090
date: 2026/09/16
// Security Arsenal — OTX Pulse Hunt: C2Looper / Mythic C2 / QUICSILVER
// Microsoft Sentinel — 30-day retro sweep
let mythicIPs = dynamic(["142.93.52.11","65.87.7.11","194.26.192.117","68.178.205.17","192.169.176.54","68.178.202.150","170.64.183.242"]);
let c2looperHashes = dynamic(["f59f32c9af4fa8a5dbd4668df8893593bc0c4324816cbf9b956acedcbfb8cdb6","f96ff2f3abbff7f382ace509b90e54853b4b61c402ecde27d82f1c17b414867b","20675a659c338f7267fd09bacb431f4491f061d3acf42d07aca2dec3d25fa549"]);
let quicsilverHashes = dynamic(["c4b4647795567ab15528edd1ab1bf37fb50e21b442e59a653051061973e87c02","0803521a7e9081f46f8f9f61d72371ecc1f49657f10202fffa9a33f581d8bb39","6e66d673306fc57d6479422e1e8cc17c5dbf94e8","9216fcae1736e8ff7cbed130677a52e3daf93dc1","c06b90b06caf4e2e8d9eeef84c34ca84a2f40fa7","5a91a13e681788ab02354f2fc2f82355","a204bc8249df2b64dfab8181172c25ee","b9622eb982f7c8b9885c932ca54339a0"]);
let netHits = DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemoteIP in (mythicIPs)
or (RemoteUrl has_any ("api.github.com","raw.githubusercontent.com","gist.githubusercontent.com","workers.dev")
and InitiatingProcessFileName !in~ ("chrome.exe","msedge.exe","firefox.exe","git.exe","code.exe","githubdesktop.exe"))
| project TimeGenerated, DeviceName, RemoteIP, RemoteUrl, RemotePort, InitiatingProcessFileName, InitiatingProcessCommandLine
| extend HuntTag = "Network";
let procHits = DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where SHA256 in (c2looperHashes) or SHA256 in (quicsilverHashes) or MD5 in (quicsilverHashes) or SHA1 in (quicsilverHashes)
or (ProcessCommandLine has_any (".vhd",".vhdx",".jpg.vhd","FromBase64String","DownloadString","IEX")
and InitiatingProcessFileName in~ ("explorer.exe","chrome.exe","msedge.exe","outlook.exe","winword.exe"))
| project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, ProcessCommandLine, InitiatingProcessFileName
| extend HuntTag = "Process";
union netHits, procHits
| sort by TimeGenerated desc
# Security Arsenal — OTX Pulse IOC Hunt: C2Looper / Mythic / QUICSILVER
# Run elevated on suspected endpoints or via your EDR/remote shell of choice.
$MythicIPs = @('142.93.52.11','65.87.7.11','194.26.192.117','68.178.205.17','192.169.176.54','68.178.202.150','170.64.183.242')
$C2LooperSHA256 = @('f59f32c9af4fa8a5dbd4668df8893593bc0c4324816cbf9b956acedcbfb8cdb6','f96ff2f3abbff7f382ace509b90e54853b4b61c402ecde27d82f1c17b414867b','20675a659c338f7267fd09bacb431f4491f061d3acf42d07aca2dec3d25fa549')
$QuicsilverSHA256 = @('c4b4647795567ab15528edd1ab1bf37fb50e21b442e59a653051061973e87c02','0803521a7e9081f46f8f9f61d72371ecc1f49657f10202fffa9a33f581d8bb39')
$AllHashes = $C2LooperSHA256 + $QuicsilverSHA256
$findings = @()
# 1) Active/recent network connections to Mythic C2 IPs
$conns = Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object { $MythicIPs -contains $_.RemoteAddress }
$udp443 = Get-NetUDPEndpoint -ErrorAction SilentlyContinue
foreach ($c in $conns) {
$p = Get-Process -Id $c.OwningProcess -ErrorAction SilentlyContinue
$findings += [pscustomobject]@{Type='MythicC2-Connection'; Detail="$($c.LocalAddress):$($c.LocalPort) -> $($c.RemoteAddress):$($c.RemotePort) [$($p.ProcessName)]"}
}
# 2) Non-browser QUIC (UDP/443) sockets — QUICAgent tradecraft
foreach ($u in $udp443) {
$p = Get-Process -Id $u.OwningProcess -ErrorAction SilentlyContinue
if ($p -and $p.ProcessName -notmatch 'chrome|msedge|firefox|brave|teams|onedrive') {
$findings += [pscustomobject]@{Type='Suspicious-QUIC-UDP443'; Detail="Process $($p.ProcessName) (PID $($p.Id)) holding UDP/443 endpoint — investigate QUICAgent"}
}
}
# 3) Mounted VHD/VHDX volumes — QUICSILVER delivery artifact
$vhds = Get-Disk -ErrorAction SilentlyContinue | Where-Object { $_.FriendlyName -match 'Virtual|Msft' }
foreach ($v in $vhds) {
$findings += [pscustomobject]@{Type='Mounted-VHD'; Detail="Virtual disk mounted: $($v.FriendlyName) Serial=$($v.SerialNumber)"}
}
# 4) Hash sweep of common staging locations
$paths = @("$env:TEMP","$env:APPDATA","$env:LOCALAPPDATA","$env:USERPROFILE\Downloads","C:\ProgramData","C:\Users\Public")
foreach ($path in $paths) {
Get-ChildItem -Path $path -Recurse -File -ErrorAction SilentlyContinue -Include *.exe,*.dll,*.vhd,*.vhdx,*.lnk,*.js,*.ps1 | ForEach-Object {
$h = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
if ($AllHashes -contains $h.ToLower()) {
$findings += [pscustomobject]@{Type='IOC-Hash-Match'; Detail="$($_.FullName) SHA256=$h"}
}
}
}
# 5) Persistence surface check: Run keys + scheduled tasks referencing scripts/github
$runKeys = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run','HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run')
foreach ($rk in $runKeys) {
Get-ItemProperty -Path $rk -ErrorAction SilentlyContinue | ForEach-Object {
$_.PSObject.Properties | Where-Object { $_.Value -match 'powershell|mshta|wscript|rundll32|github|vhd' } | ForEach-Object {
$findings += [pscustomobject]@{Type='Suspicious-RunKey'; Detail="$rk :: $($_.Name) = $($_.Value)"}
}
}
}
Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object { $_.Actions.Execute -match 'powershell|mshta|wscript' -or $_.Actions.Arguments -match 'github|vhd|base64' } | ForEach-Object {
$findings += [pscustomobject]@{Type='Suspicious-ScheduledTask'; Detail="$($_.TaskName) -> $($_.Actions.Execute) $($_.Actions.Arguments)"}
}
if ($findings.Count -gt 0) { $findings | Format-Table -AutoSize; $findings | Export-Csv -Path ".\otx_hunt_$(hostname)_$(Get-Date -Format yyyyMMdd_HHmmss).csv" -NoTypeInformation }
else { Write-Output "[+] No OTX pulse indicators found on $(hostname)." }
Response Priorities
Immediate (0–4 hours)
- Push the 7 Mythic C2 IPv4 indicators (and pull the full 131-host list from the Censys research) to egress firewall, proxy, and DNS sinkhole block lists.
- Add all C2Looper and QUICSILVER file hashes to EDR block/deny policies; run the retro sweep KQL across 30 days of telemetry.
- Alert on any non-browser process establishing HTTPS to GitHub API/raw endpoints and any non-browser QUIC (UDP/443) flow — these are the two highest-fidelity behavioral signals in this pulse set.
- Hunt for ClickFix artifacts: browser-spawned PowerShell/mshta with Base64 or download cradles.
24 Hours
- C2Looper is ransomware-adjacent initial access tooling; Oyster/Lactrodectus chains frequently carry credential and session-theft components. If any host shows C2Looper or ClickFix execution, force credential resets for all users of that host, revoke active sessions and tokens, and review authentication logs for impossible travel or token replay.
- For any Myanmar-adjacent or government-sector business units (or partners), brief on the QUICSILVER lure themes (Burmese graduation invitations, IT department impersonation) and flag inbound VHD/VHDX attachments for detonation.
- Validate email gateway blocks VHD/VHDX and double-extension attachments outright.
1 Week
- Architecturally restrict QUIC: force UDP/443 through inspection or block outbound QUIC for non-browser processes at the endpoint firewall, forcing fallback to inspectable TCP/TLS.
- Implement application allowlisting rules blocking user-writable directory execution and unsigned DLL sideloading against the signed binaries abused by C2Looper.
- Deploy the Sigma rules above into production with a 14-day tuning window; baseline developer GitHub usage to reduce false positives on the C2Looper network rule.
- Stand up continuous Censys/Shodan monitoring for Mythic panel fingerprints on ASNs adjacent to your threat model, feeding newly discovered hosts into block lists automatically.
Related Resources
Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.