Cl0p LEMURLOOT MFT Exploitation + Jewelbug REF7707 Antino Backdoor: OTX Pulse Analysis — Enterprise Detection Pack

---
title: Cl0p LEMURLOOT Web Shell Activity on Managed File Transfer Servers
id: 3f1a9c2e-7d4b-4e8a-b1c5-9a2f6d0e1b3c
status: experimental
description: Detects web server processes on MFT appliances (MOVEit, GoAnywhere, Serv-U) spawning command shells or scripting engines, consistent with Cl0p zero-day exploitation and web shell deployment (CVE-2023-34362 pattern).
author: Security Arsenal Threat Intel
references:
    - https://www.team-cymru.com/post/cl0p-ransomware-mft-attack-pattern-threat-intelligence
date: 2026/09/13
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\w3wp.exe'
            - '\httpd.exe'
            - '\nginx.exe'
            - '\tomcat9.exe'
            - '\java.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\certutil.exe'
            - '\bitsadmin.exe'
            - '\rundll32.exe'
    filter_paths:
        CommandLine|contains:
            - 'Windows Update'
            - 'healthcheck'
    condition: selection_parent and selection_child and not filter_paths
falsepositives:
    - Legitimate MFT administrative scripting; baseline per host.
level: high
tags:
    - attack.initial_access
    - attack.t1190
    - attack.t1505.003
    - attack.execution
    - attack.t1059
---
title: Jewelbug REF7707 Antino / XG-Web C2 DNS and Network Communication
id: 8c2e5f1a-4b6d-4a9c-92e1-5f7c3a8d0b2e
status: experimental
description: Detects DNS queries or network connections to known Jewelbug (REF7707) XG-Web control panel and Antino backdoor C2 infrastructure identified in OTX pulses.
author: Security Arsenal Threat Intel
references:
    - https://sed-cms.broadcom.com/sites/default/files/2026-08/Jewelbug%20Dossier.pdf
date: 2026/09/13
logsource:
    category: dns
detection:
    selection:
        query|contains:
            - 'jkskhei.com'
            - 'juliangip.com'
            - 'sttlink.com'
            - 'bieqiang.xyz'
            - 'longmingdns.com'
            - 'pubstorm.com'
            - 'pubstorm.net'
    condition: selection
falsepositives:
    - Threat research or sandbox detonation traffic.
level: critical
tags:
    - attack.command_and_control
    - attack.t1071
    - attack.t1568
---
title: Trojanized PDF Viewer or Browser Credential Access Consistent with Jewelbug ClientKing
id: 5d9a3e7b-1c4f-4b8d-a6e2-3c8f1b5d9a7e
status: experimental
description: Detects suspicious processes accessing browser credential stores (Chrome/Edge Login Data), a behavior tied to Jewelbug's 580K+ stolen browser credentials via Antino and ClientKing implants.
author: Security Arsenal Threat Intel
date: 2026/09/13
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|contains:
            - '\Google\Chrome\User Data\'
            - '\Microsoft\Edge\User Data\'
        TargetFilename|endswith:
            - 'Login Data'
            - 'Web Data'
            - 'Cookies'
            - 'Local State'
    filter_legit:
        Image|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\MsMpEng.exe'
    condition: selection and not filter_legit
falsepositives:
    - Backup software, legitimate password managers, EDR scanners — allowlist per environment.
level: high
tags:
    - attack.credential_access
    - attack.t1555.003
    - attack.collection

// Jewelbug (REF7707) + Cl0p infrastructure hunt — Microsoft Sentinel
// Coverage: Antino/XG-Web C2, Cl0p leak infrastructure, and web-shell process chains on MFT servers
let Lookback = 30d;
let JewelbugC2 = dynamic(["jkskhei.com","juliangip.com","sttlink.com","bieqiang.xyz","longmingdns.com"]);
let Cl0pInfra = dynamic(["pubstorm.com","pubstorm.net"]);
let NetworkHits = DeviceNetworkEvents
    | where Timestamp > ago(Lookback)
    | where RemoteUrl has_any (JewelbugC2) or RemoteUrl has_any (Cl0pInfra)
    | project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort;
let DnsHits = DeviceNetworkEvents
    | where Timestamp > ago(Lookback)
    | extend RemoteUrl = tostring(RemoteUrl)
    | where isnotempty(RemoteUrl)
    | where RemoteUrl has_any (JewelbugC2) or RemoteUrl has_any (Cl0pInfra);
let WebShellChain = DeviceProcessEvents
    | where Timestamp > ago(Lookback)
    | where InitiatingProcessFileName in~ ("w3wp.exe","java.exe","tomcat9.exe","nginx.exe","httpd.exe")
    | where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","certutil.exe","bitsadmin.exe","rundll32.exe")
    | project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName;
union NetworkHits, WebShellChain
| sort by Timestamp desc

# Security Arsenal — Jewelbug/Cl0p IOC Hunt Script
# Checks: Jewelbug C2 connections, Antino/ClientKing file hashes, browser credential-store tampering, suspicious persistence
param([string]$ReportPath = "$env:TEMP\ioc_hunt_$(Get-Date -Format yyyyMMdd_HHmmss).txt")

$ErrorActionPreference = 'SilentlyContinue'
"=== Jewelbug (REF7707) / Cl0p IOC Hunt — $(Get-Date) ===" | Out-File $ReportPath

# 1. Active/historical network connections to known C2
"`n[1] Network connections to Jewelbug/Cl0p C2 domains:" | Out-File $ReportPath -Append
$C2 = @('jkskhei.com','juliangip.com','sttlink.com','bieqiang.xyz','longmingdns.com','pubstorm.com','pubstorm.net')
foreach ($d in $C2) {
    $res = Resolve-DnsName -Name $d -ErrorAction SilentlyContinue
    if ($res) { "  [HIT] DNS resolves: $d -> $($res.IPAddress -join ',')" | Out-File $ReportPath -Append }
}
Get-NetTCPConnection | Where-Object { $_.State -eq 'Established' } | ForEach-Object {
    $host_ = (Resolve-DnsName -Name $_.RemoteAddress -Type PTR -ErrorAction SilentlyContinue).NameHost
    if ($host_ -and ($C2 | Where-Object { $host_ -like "*$_*" })) {
        "  [HIT] Live connection to $host_ ($($_.RemoteAddress):$($_.RemotePort)) PID $($_.OwningProcess)" | Out-File $ReportPath -Append
    }
}

# 2. Antino / ClientKing file hash sweep (common staging paths)
"`n[2] File hash sweep (Antino/ClientKing/PDF Viewer samples):" | Out-File $ReportPath -Append
$Hashes = @(
 'e6ff096a0562c0042b09d250bd60272ffcd8d72bd95c563842acf765a8dc8bcf',
 '01b5c6acb20e41799a0e96d9d1d6e1c44791883706b6285e874fcb15cc93b31a',
 'e809da86bd81463347fa7f922d3e088755a94a331889d32acb55aa8f57778a34',
 'f1ef5fe4c0cdcff13cc750c867728b89719f81437bdc49041edd1ae1f3edb4e8',
 'e2eb7703047b37b28dc34e6990205d758a2454b39bc655b460606745fadcb530',
 'e7e3b0bcd6798634adf8b49d305f3a7b7682e4b76db549682a183c5a186df4bb'
)
$Paths = @("$env:TEMP","$env:APPDATA","$env:LOCALAPPDATA","$env:ProgramData","$env:USERPROFILE\Downloads")
foreach ($p in $Paths) {
    Get-ChildItem -Path $p -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
        $h = (Get-FileHash -Algorithm SHA256 -Path $_.FullName -ErrorAction SilentlyContinue).Hash
        if ($h -and $Hashes -contains $h.ToLower()) {
            "  [CRITICAL HIT] $($_.FullName) matches known implant hash $h" | Out-File $ReportPath -Append
        }
    }
}

# 3. Browser credential-store access artifacts (Jewelbug stole 580K+ browser creds)
"`n[3] Browser credential store integrity check:" | Out-File $ReportPath -Append
$CredPaths = @("$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Login Data",
               "$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default\Login Data")
foreach ($cp in $CredPaths) {
    if (Test-Path $cp) {
        $f = Get-Item $cp
        "  $($f.FullName) — LastWrite: $($f.LastWriteTime), LastAccess: $($f.LastAccessTime)" | Out-File $ReportPath -Append
        if ($f.LastAccessTime -gt (Get-Date).AddHours(-24) -and $f.LastAccessTime -gt $f.LastWriteTime) {
            "  [SUSPICIOUS] Recent read access without browser session write — investigate credential theft" | Out-File $ReportPath -Append
        }
    }
}

# 4. Persistence: Run keys and scheduled tasks with non-standard binaries
"`n[4] Persistence mechanism review:" | Out-File $ReportPath -Append
$RunKeys = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
             'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run')
foreach ($rk in $RunKeys) {
    Get-ItemProperty -Path $rk | ForEach-Object {
        $_.PSObject.Properties | Where-Object { $_.Value -match 'AppData|Temp|ProgramData' } | ForEach-Object {
            "  [REVIEW] $rk :: $($_.Name) = $($_.Value)" | Out-File $ReportPath -Append
        }
    }
}
Get-ScheduledTask | Where-Object { $_.TaskPath -notlike '\Microsoft*' } | ForEach-Object {
    $act = ($_.Actions | Select-Object -First 1).Execute
    if ($act -match 'AppData|Temp|pdf|viewer') {
        "  [REVIEW] Task '$($_.TaskName)' executes $act" | Out-File $ReportPath -Append
    }
}

# 5. MFT service exposure check (Cl0p vector)
"`n[5] Managed File Transfer service check (Cl0p target surface):" | Out-File $ReportPath -Append
Get-Service | Where-Object { $_.DisplayName -match 'MOVEit|GoAnywhere|Serv-U|Accellion|FileCatalyst|Aspera' } | ForEach-Object {
    "  [ALERT] MFT service present: $($_.DisplayName) — Status: $($_.Status) — verify patch level vs CVE-2023-34362 and related CVEs" | Out-File $ReportPath -Append
}

"`n=== Hunt complete. Review all [HIT]/[CRITICAL]/[SUSPICIOUS] entries. Report: $ReportPath ===" | Out-File $ReportPath -Append
Write-Host "Hunt complete -> $ReportPath"