Cisco SD-WAN Zero-Days & NPM Supply Chain Attacks: UAT-8616, FAMOUS CHOLLIMA, and Interlock Campaigns

---
title: Potential Cisco SD-WAN Webshell Execution
date: 2026/05/18
author: Security Arsenal
status: experimental
description: Detects potential webshell activity associated with UAT-8616 exploiting Cisco SD-WAN vulnerabilities. Looks for suspicious process execution patterns on the management interface or common webshell binaries.
references:
    - https://blog.talosintelligence.com/sd-wan-ongoing-exploitation/
tags:
    - attack.persistence
    - attack.t1505.003
    - cve-2026-20128
    - cve-2026-20133
logsource:
    category: process_creation
    product: linux
detection:
    selection_img:
        Image|endswith:
            - '/java'
            - '/tomcat'
    selection_cli:
        CommandLine|contains:
            - 'XenShell'
            - 'Godzilla'
            - 'Behinder'
            - 'bash -i'
            - 'nc -e'
    selection_parent:
        ParentImage|contains:
            - 'vshell'
            - 'sd-wan'
    condition: 1 of selection_*
falsepositives:
    - Legitimate administrative troubleshooting
level: critical

---
title: Malicious NPM Package Execution (OtterCookie)
date: 2026/05/18
author: Security Arsenal
status: experimental
description: Detects execution of node processes linked to the OtterCookie campaign. Hunt for obfuscated packages or arguments matching known malicious families like BeaverTail or Koalemos.
references:
    - https://panther.com/blog/tracking-an-ottercookie-infostealer-campaign-across-npm
tags:
    - attack.initial_access
    - attack.t1195.002
    - npm
    - supply-chain
logsource:
    category: process_creation
    product: windows
detection:
    selection_node:
        Image|endswith: '\node.exe'
    selection_suspicious_args:
        CommandLine|contains:
            - 'ottercookie'
            - 'beavertail'
            - 'koalemos'
            - 'invisibleferret'
    selection_obfuscation:
        CommandLine|contains:
            - 'eval('
            - 'Buffer.from'
    condition: all of selection_*
falsepositives:
    - Legitimate obfuscated npm scripts
level: high

---
title: Ransomware Loader Activity - PlasmaLoader
id: 43f14e6c-0b99-4a6a-9c6e-7186236889e8
description: Detects execution artifacts associated with PlasmaLoader and GhostKnife ransomware components used by Interlock Group.
references:
    - https://www.recordedfuture.com/blog/march-2026-cve-landscape
tags:
    - attack.execution
    - attack.t1059.001
    - ransomware
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\rundll32.exe'
            - '\regsvr32.exe'
        CommandLine|contains:
            - 'PlasmaLoader'
            - 'GHOSTSABER'
            - 'GHOSTKNIFE'
            - '.dll,RunDLL'
    condition: selection
falsepositives:
    - Unknown
level: critical


kql
// Hunt for C2 connections associated with UAT-8616 and known bad IPs
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteIP in ("176.65.139.31") // Expand with additional IOCs from Pulse
| summarize Count=count(), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName

// Hunt for suspicious npm processes related to OtterCookie
DeviceProcessEvents
| where Timestamp > ago(30d)
| where FileName =~ "node.exe"
| where ProcessCommandLine has_any ("ottercookie", "beavertail", "koalemos", "invisibleferret", "vercel")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, FolderPath

// Hunt for Cisco FMC exploit patterns (CVE-2026-20131)
SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 4624 or EventID == 5140
| where TargetUserName has "admin" and WorkstationName has "FMC" or WorkstationName has "Cisco"
| project TimeGenerated, Account, TargetUserName, WorkstationName, IpAddress


powershell
# IOC Hunt Script: Check for UAT-8616 File Hashes and Suspicious Paths

$MaliciousHashes = @(
    "d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa",
    "d75cb9920d1d3d280518ddccfe4789d2"
)

Write-Host "[+] Scanning for UAT-8616 Malware Artifacts..." -ForegroundColor Cyan

# Scan C: drive for file hashes (This may take time)
foreach ($hash in $MaliciousHashes) {
    $result = Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue | 
              Get-FileHash -Algorithm SHA256 -ErrorAction SilentlyContinue | 
              Where-Object { $_.Hash -eq $hash }
    
    if ($result) {
        Write-Host "[!] MATCH FOUND: $($result.Path) matches hash $hash" -ForegroundColor Red
    }
}

# Check for typical XMRig or Webshell paths on Linux/Windows systems
$SuspiciousPaths = @(
    "C:\Windows\Temp\XMRig",
    "C:\ProgramData\XenShell",
    "/tmp/.XMRig",
    "/var/tmp/godzilla.jsp"
)

foreach ($path in $SuspiciousPaths) {
    if (Test-Path $path) {
        Write-Host "[!] Suspicious Path Found: $path" -ForegroundColor Yellow
        Get-ChildItem $path -Recurse -ErrorAction SilentlyContinue | Select-Object FullName, LastWriteTime
    }
}

Write-Host "[+] Hunt Complete. Investigate any RED or YELLOW findings immediately." -ForegroundColor Green