China-Nexus Spray-and-Check Campaign: GOCS, SNOWLIGHT, Neo-reGeorg Infrastructure — OTX Pulse Analysis

title: Potential C2 Connection to China-Nexus Infrastructure
id: 8a4b2c1d-5e6f-4a3b-8c9d-1e2f3a4b5c6d
description: Detects network connections to known IP infrastructure associated with the China-nexus spray-and-check campaign (CVE-2025-24813).
status: experimental
date: 2026/08/05
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/62000000
tags:
    - c2.traffic
    - attack.command_and_control
    - apt
logsource:
    category: network_connection
product: windows
detection:
    selection:
        DestinationIp|startswith:
            - '130.94.17.'
            - '130.94.30.'
            - '221.198.83.'
            - '149.129.37.'
            - '92.38.135.'
        DestinationPort|between: 1-65535
    condition: selection
falsepositives:
    - Legitimate traffic to compromised hosts
level: critical
---
title: Malicious Payload Execution - GOCS/SNOWLIGHT Loader
description: Detects the execution of a file with the specific SHA256 hash associated with the GOCS/SNOWLIGHT loader.
id: 1d2e3f4a-5b6c-7d8e-9f0a-1b2c3d4e5f6a
status: experimental
date: 2026/08/05
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/62000000
tags:
    - attack.execution
    - attack.initial_access
    - malware.gocs
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Hashes|contains: 'd7ed70cdd88f6cccbdc0ad6851d7a61b7fce79fdf9c4cd9f9bb375233a96b2dd'
    condition: selection
falsepositives:
    - None
level: critical
---
title: Potential Neo-reGeorg Webshell Activity
description: Detects potential Neo-reGeorg webshell usage based on common URI patterns and specific C2 IPs.
id: 2a3b4c5d-6e7f-8a9b-0c1d-2e3f4a5b6c7d
status: experimental
date: 2026/08/05
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/62000000
tags:
    - attack.persistence
    - attack.webshell
    - attack.t1505.003
logsource:
    category: web_access
    product: apache
    service: httpd
detection:
    selection_ip:
        cIP|startswith:
            - '130.94.17.'
            - '130.94.30.'
    selection_uri:
        csUriQuery|contains:
            - 'cmd='
            - 'tunnel'
    condition: 1 of selection*
falsepositives:
    - Legitimate administrative access
level: high

// Hunt for network connections to known C2 infrastructure
let IOC_IPs = dynamic(['130.94.17.180', '130.94.30.168', '221.198.83.248', '149.129.37.105', '92.38.135.196']);
DeviceNetworkEvents
| where RemoteIP in (IOC_IPs) or RemoteIP has_any_prefix ('130.94.17.', '130.94.30.')
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteIP, RemotePort, RemoteUrl
| summarize count() by DeviceName, RemoteIP
| extend AlertMessage = "Potential C2 connection to China-nexus infrastructure"
;

// Hunt for specific file hash on endpoints
let MaliciousHash = 'd7ed70cdd88f6cccbdc0ad6851d7a61b7fce79fdf9c4cd9f9bb375233a96b2dd';
DeviceFileEvents
| where SHA256 == MaliciousHash
| project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessAccountName, SHA256
| extend AlertMessage = "Detection of GOCS/SNOWLIGHT payload"

# IOC Hunt Script: China-Nexus Spray-and-Check Campaign
# Checks for active network connections to malicious IPs and file system presence of known payload hashes

$MaliciousIPs = @( 
    '130.94.17.180', '130.94.30.168', 
    '221.198.83.248', '149.129.37.105', '92.38.135.196' 
)

$MaliciousHash = 'd7ed70cdd88f6cccbdc0ad6851d7a61b7fce79fdf9c4cd9f9bb375233a96b2dd'

Write-Host "[+] Checking active network connections for known C2 IPs..." -ForegroundColor Cyan

$activeConnections = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue

foreach ($ip in $MaliciousIPs) {
    $matches = $activeConnections | Where-Object { $_.RemoteAddress -eq $ip }
    if ($matches) {
        Write-Host "[!] ALERT: Connection detected to $ip" -ForegroundColor Red
        $matches | Format-Table LocalAddress, LocalPort, RemoteAddress, RemotePort, OwningProcess -AutoSize
        $matches | ForEach-Object { Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue | Select-Object ProcessName, Id, Path }
    }
}

Write-Host "[+] Scanning file system for known payload hash ($MaliciousHash)..." -ForegroundColor Cyan

# Searching common drive roots, adjust as necessary for your environment
$drives = Get-PSDrive -PSProvider FileSystem | Select-Object -ExpandProperty Root

foreach ($drive in $drives) {
    Write-Host "Scanning $drive..."
    try {
        Get-ChildItem -Path $drive -Recurse -ErrorAction SilentlyContinue | 
        ForEach-Object {
            $hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($hash -eq $MaliciousHash) {
                Write-Host "[!] ALERT: Malicious file found at $($_.FullName)" -ForegroundColor Red
            }
        }
    }
    catch {
        # Ignore access errors
    }
}

Write-Host "[+] Hunt complete."