Cisco SD-WAN Exploit & Npm Supply Chain Attack: UAT-8616 & Chollima Campaign

title: Potential Cisco SD-WAN Webshell Activity UAT-8616
id: 4a8f9c12-5b6a-4f6d-8e1a-3c2b4d5e6f7a
description: Detects potential webshell activity associated with UAT-8616 exploitation of Cisco SD-WAN, characterized by suspicious processes spawned by web server binaries or uncommon Linux executables like XenShell/Sliver.
status: experimental
date: 2026/05/16
author: Security Arsenal
logsource:
  product: linux
  service: auditd or process

detection:
  selection_parent:
    ParentImage|endswith:
      - '/nginx'
      - '/apache2'
      - '/lighttpd'
      - '/java'
      - '/tomcat'
  selection_child:
    Image|contains:
      - 'sh'
      - 'bash'
      - 'perl'
      - 'python'
      - 'php'
    CommandLine|contains:
      - 'wget'
      - 'curl'
      - 'nc.traditional'
      - 'chmod 777'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate administrative scripts
level: high

tags:
  - attack.initial_access
  - attack.persistence
  - cve.2026.20182
  - apt.8616
---
title: Suspicious Node.js Child Process Execution Supply Chain
id: b7g0h1i2-j3k4-l5m6-n7o8-p9q0r1s2t3u4
description: Detects Node.js processes spawning cmd.exe or powershell.exe, a common behavior in npm supply chain attacks like OtterCookie/BeaverTail used by FAMOUS CHOLLIMA.
status: experimental
date: 2026/05/16
author: Security Arsenal
logsource:
  category: process_creation
  product: windows

detection:
  selection_parent:
    Image|endswith:
      - '\node.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate developer build scripts
level: high

tags:
  - attack.execution
  - attack.initial_access
  - supply.chain
  - npm.malware
---
title: Linux Cryptominer XMRig Execution
id: c8d9e0f1-2a3b-4c5d-6e7f-8a9b0c1d2e3f
description: Detects execution of XMRig or similar cryptomining utilities often deployed post-exploitation by UAT-8616.
status: experimental
date: 2026/05/16
author: Security Arsenal
logsource:
  product: linux
  service: process

detection:
  selection_img:
    Image|contains:
      - 'xmrig'
      - 'cpuminer'
      - 'minerd'
  selection_cli:
    CommandLine|contains:
      - '--donate-level'
      - '--url='
      - '--user='
      - 'stratum+tcp'
  condition: selection_img or selection_cli
falsepositives:
  - Authorized mining operations
level: critical

tags:
  - attack.impact
  - attack.resource_hijacking

// Hunt for UAT-8616 C2 IP and Hashes
let IOCs = dynamic([
    "176.65.139.31",
    "d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa",
    "d75cb9920d1d3d280518ddccfe4789d2",
    "18821dbb53892d6faa14b1f063517a0302057290"
]);
// Network Connections to malicious IP
DeviceNetworkEvents
| where RemoteIP in (IOCs)
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteIP, RemotePort, InitiatingProcessCommandLine
| union (
    // File Hash Matches
    DeviceFileEvents
    | where SHA256 in (IOCs) or MD5 in (IOCs) or SHA1 in (IOCs)
    | project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessAccountName
)
| extend Severity = "High"

# IOC Scanner for UAT-8616 and OtterCookie Campaigns
# Requires Admin privileges for full disk scan

$MaliciousHashes = @(
    "d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa",
    "d75cb9920d1d3d280518ddccfe4789d2",
    "18821dbb53892d6faa14b1f063517a0302057290"
)

Write-Host "[+] Starting IOC Hunt for UAT-8616 / Chollima Indicators..." -ForegroundColor Cyan

# Scan common npm/cache directories for malicious files
$PathsToScan = @(
    "$env:APPDATA\npm",
    "$env:USERPROFILE\AppData\Roaming\npm-cache",
    "$env:LOCALAPPDATA\Yarn",
    "C:\ProgramData\npm"
)

foreach ($path in $PathsToScan) {
    if (Test-Path $path) {
        Write-Host "[+] Scanning $path..." -ForegroundColor Yellow
        Get-ChildItem -Path $path -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
            $hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($MaliciousHashes -contains $hash) {
                Write-Host "[!] MALICIOUS FILE FOUND: $($_.FullName) | Hash: $hash" -ForegroundColor Red
            }
        }
    }
}

# Check for suspicious network connections (Simulated via netstat, typically use EDR API)
Write-Host "[+] Checking for established connections to 176.65.139.31..." -ForegroundColor Yellow
$netstat = netstat -ano | Select-String "176.65.139.31"
if ($netstat) {
    Write-Host $netstat -ForegroundColor Red
} else {
    Write-Host "[-] No connections found to malicious IP." -ForegroundColor Green
}

Write-Host "[+] Hunt Complete." -ForegroundColor Cyan