CL-STA-1178 Blinder Tunnel + ShelbyLoader V2, Fake AI Ads Phishing Platform, and AWS Bedrock Token-Jacking: OTX Pulse Analysis — Credential Theft Detection Pack

---
title: AppDomainManager Hijacking - Malicious .NET Configuration (CL-STA-1178 / ShelbyLoader V2)
id: 8f3a1c2e-1178-4b7a-9c1d-blinder00001
status: experimental
description: Detects creation or modification of .NET application configuration files specifying a custom AppDomainManager assembly, a persistence and defense-evasion technique used by CL-STA-1178 ShelbyLoader V2.
author: Security Arsenal Threat Intel
date: 2026/10/07
references:
    - https://unit42.paloaltonetworks.com/blinder-tunnel-targets-critical-infrastructure/
logsource:
    category: file_event
    product: windows
detection:
    selection_ext:
        TargetFilename|endswith: '.config'
    selection_content:
        TargetFilename|contains:
            - '\AppData\'
            - '\ProgramData\'
            - '\Users\Public\'
    filter_legit_paths:
        TargetFilename|contains:
            - '\Program Files\'
            - '\Windows\Microsoft.NET\'
    condition: selection_ext and selection_content and not filter_legit_paths
falsepositives:
    - Legitimate .NET application deployments writing config files to user profiles
level: high
tags:
    - attack.persistence
    - attack.defense_evasion
    - attack.t1574
---
title: DLL Sideloading of RuntimeBroker or Proxy-Themed Payload DLLs
id: 8f3a1c2e-1178-4b7a-9c1d-blinder00002
status: experimental
description: Detects image loads of RuntimeBroker.dll, PsProxy.dll, or Blackwood.dll from non-system paths, matching CL-STA-1178 staged sideloading behavior.
author: Security Arsenal Threat Intel
date: 2026/10/07
logsource:
    category: image_load
    product: windows
detection:
    selection_dll:
        ImageLoaded|endswith:
            - '\RuntimeBroker.dll'
            - '\PsProxy.dll'
            - '\Blackwood.dll'
    filter_system:
        ImageLoaded|startswith:
            - 'C:\Windows\System32\'
            - 'C:\Windows\SysWOW64\'
    condition: selection_dll and not filter_system
falsepositives:
    - Rare third-party software shipping same-named DLLs
level: critical
tags:
    - attack.defense_evasion
    - attack.t1574.002
---
title: Chisel Tunnel Execution or GitHub-Based Covert C2 Indicator
id: 8f3a1c2e-1178-4b7a-9c1d-blinder00003
status: experimental
description: Detects Chisel tunneling client/server execution via command-line artifacts (client/server modes, socks, reverse flags) associated with Blinder Tunnel campaign covert channels.
author: Security Arsenal Threat Intel
date: 2026/10/07
logsource:
    category: process_creation
    product: windows
detection:
    selection_cli:
        CommandLine|contains:
            - ' client '
            - ' server '
    selection_flags:
        CommandLine|contains:
            - 'R:socks'
            - '--socks5'
            - '--reverse'
            - ':socks'
    selection_img:
        Image|endswith:
            - '\chisel.exe'
            - '\chisel'
    condition: (selection_cli and selection_flags) or selection_img
falsepositives:
    - Legitimate penetration testing or red team activity using Chisel
level: high
tags:
    - attack.command_and_control
    - attack.t1572
    - attack.t1090

// Hunt: CL-STA-1178 IOCs, Fake AI Ads BitB domains, and AWS Bedrock validator infrastructure
let C2_IPs = dynamic(["87.248.129.239","112.78.151.90","78.109.78.211","83.194.172.248","103.160.185.100","109.146.93.39","115.138.247.83"]);
let PhishDomains = dynamic(["sync-account.com","verification-security.com","payment-confirm.com","claude-ads.ai","claude-advertisers.ai","gemini-ads-team.com","gemini-advertisers.com","manusbymeta.com"]);
let MalHashes = dynamic(["6e7d9b33f1e72ea1ede71373a604ecdb060dab7d42055179c1eede9ecd1fd239","f5b12772db6817f7a765a6fe7565fd3d4f87edc28e42fe3ec0244a372a410fc9","53f35e49eb9b271fd8cbcd3daacb525328dbf159a03dbd1c7adebe0363daa402","923641364ef0ce3a6f1d944890244082b8c7f29c9600c0433b2a0ca9822c0608","c9335bb8a21bd2c568d03b040fb86a0e72145691e54a33495ee0cfaac55835dc"]);
let NetworkHits = DeviceNetworkEvents
| where RemoteIP in (C2_IPs) or RemoteUrl has_any (PhishDomains)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort, ActionType;
let HashHits = DeviceProcessEvents
| where SHA256 in (MalHashes)
| project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, ProcessCommandLine, AccountName;
let SideloadHits = DeviceImageLoadEvents
| where FileName in~ ("RuntimeBroker.dll","PsProxy.dll","Blackwood.dll")
| where FolderPath !startswith "C:\\Windows\\System32" and FolderPath !startswith "C:\\Windows\\SysWOW64"
| project TimeGenerated, DeviceName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine;
union NetworkHits, HashHits, SideloadHits
| sort by TimeGenerated desc

# Security Arsenal — CL-STA-1178 / BitB Phishing / Bedrock Validator Hunt
# Run elevated. Checks network IOCs, AppDomainManager hijack artifacts, sideloaded DLLs, and phishing DNS cache.

$C2IPs = @("87.248.129.239","112.78.151.90","78.109.78.211","83.194.172.248","103.160.185.100","109.146.93.39","115.138.247.83")
$PhishDomains = @("sync-account.com","verification-security.com","payment-confirm.com","claude-ads.ai","claude-advertisers.ai","gemini-ads-team.com","gemini-advertisers.com","manusbymeta.com")
$SideloadDlls = @("RuntimeBroker.dll","PsProxy.dll","Blackwood.dll")
$MalHashes = @("6e7d9b33f1e72ea1ede71373a604ecdb060dab7d42055179c1eede9ecd1fd239","f5b12772db6817f7a765a6fe7565fd3d4f87edc28e42fe3ec0244a372a410fc9","53f35e49eb9b271fd8cbcd3daacb525328dbf159a03dbd1c7adebe0363daa402","3fd810a3aa0039993393741b32287c367a9a5037a41e826906440887cdd3ed13","76273382e4252c1f60a2251141e108942494409c759358320735891762c0682e","d3561bd4aad003dc3e08157b0891860bb496b80cd6e44901692e08ab1d4e8260","f5ba1645694c62f527ed6ceda8c68a5c3dd92b4032439167e8e937e72803b4bd","923641364ef0ce3a6f1d944890244082b8c7f29c9600c0433b2a0ca9822c0608","c9335bb8a21bd2c568d03b040fb86a0e72145691e54a33495ee0cfaac55835dc")

Write-Host "=== [1] Active network connections to C2/validator IPs ==="
Get-NetTCPConnection | Where-Object { $C2IPs -contains $_.RemoteAddress } |
  Select-Object LocalPort, RemoteAddress, RemotePort, State, OwningProcess,
    @{N='Process';E={(Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName}} | Format-Table -AutoSize

Write-Host "=== [2] DNS cache hits for BitB phishing domains ==="
Get-DnsClientCache | Where-Object { $d = $_.Entry; $PhishDomains | Where-Object { $d -like "*$_*" } } | Format-Table -AutoSize

Write-Host "=== [3] AppDomainManager hijack artifacts (.config files referencing custom AppDomainManager) ==="
$paths = @("$env:APPDATA","$env:LOCALAPPDATA","C:\ProgramData","C:\Users\Public")
foreach ($p in $paths) {
  Get-ChildItem -Path $p -Recurse -Filter "*.config" -ErrorAction SilentlyContinue |
    Where-Object { (Get-Content $_.FullName -Raw -ErrorAction SilentlyContinue) -match "AppDomainManager" } |
    Select-Object FullName, LastWriteTime
}

Write-Host "=== [4] Sideloaded DLLs outside System32/SysWOW64 ==="
foreach ($dll in $SideloadDlls) {
  Get-ChildItem -Path "C:\Users","C:\ProgramData" -Recurse -Filter $dll -ErrorAction SilentlyContinue |
    Select-Object FullName, Length, LastWriteTime
}

Write-Host "=== [5] Hash sweep of common staging directories ==="
foreach ($p in $paths) {
  Get-ChildItem -Path $p -Recurse -Include *.dll,*.exe -ErrorAction SilentlyContinue | ForEach-Object {
    $h = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
    if ($MalHashes -contains $h.ToLower()) { Write-Host "[!] MALICIOUS HASH: $($_.FullName)" -ForegroundColor Red }
  }
}

Write-Host "=== [6] Suspicious Chisel processes ==="
Get-CimInstance Win32_Process | Where-Object { $_.CommandLine -match "R:socks|--socks5|--reverse|chisel" } |
  Select-Object ProcessId, Name, CommandLine | Format-List

Write-Host "=== Hunt complete. Review hits and escalate per IR runbook. ==="