Three OTX pulses collectively show an enterprise threat mix dominated by extortion-grade infrastructure abuse, state-aligned cyber-espionage, and identity-focused phishing delivery. Cl0p continues a six-year pattern of zero-day exploitation against managed file transfer and edge enterprise platforms, including Accellion FTA, SolarWinds Serv-U, Fortra GoAnywhere, MOVEit Transfer, and Oracle E-Business Suite, with LEMURLOOT associated to post-exploitation theft and ransomware operations. CVE-2023-34362 remains operationally relevant because Cl0p repeatedly revisits internet-facing file transfer and application infrastructure during Q4 seasonal surges and infrastructure diversification.
Armored Likho, also tracked with Eagle Werewolf activity, is running a May 2026 espionage campaign against Russian private individuals, major corporations, public sector entities, IT companies, and educational institutions. The lure is a fake donation service application, followed by deployment of the Still Toolkit written in Rust: Still Sync for synchronization or staging, Still Audio for microphone capture and surveillance, and AquilaRAT for remote access. Objectives align with collection, credential or Telegram data theft, audio eavesdropping, and persistent access rather than immediate monetization.
The third pulse describes multi-stage phishing redirection chains abusing trusted cloud infrastructure and newly registered domains. Operators combine Framer-hosted or Framer-themed landing pages, Cloudflare Workers, HTML redirection smuggling through the Blob API, Web Crypto API decryption, brand impersonation, and device-code phishing. The objective is to defeat URL filtering by separating benign-looking redirectors from credential or token harvesting endpoints.
Collectively, these pulses point to initial access through internet edge exploitation, socially engineered application installs, and trusted SaaS redirect abuse. Enterprise security teams should prioritize edge appliance exposure review, Rust-based espionage artifact hunting, Telegram or credential theft indicators, and phishing telemetry that crosses multiple redirect domains before payload delivery.
Threat Actor / Malware Profile
Cl0p / LEMURLOOT. Distribution is primarily exploitation of public-facing managed file transfer and enterprise application platforms rather than high-volume email. Cl0p favors zero-days and architectural weaknesses in MFT products, then uses web shells, credential access, data staging, and mass exfiltration before extortion. LEMURLOOT is associated with Cl0p operations and supports post-compromise theft or ransomware-linked activity. C2 and staging infrastructure in the pulse includes IPv4 indicators 45.129.137.232, 92.118.36.233, 200.107.207.26 and domains pubstorm.com and pubstorm.net. Persistence commonly follows compromised service accounts, web shells on MFT or application servers, and legitimate remote management channels. Anti-analysis is indirect: actors leverage valid edge services, cloud fronts, and compromised administrative paths to blend with normal file transfer traffic.
Armored Likho Still Toolkit. Distribution uses fake donation service applications aimed at Russian-speaking or Russia-based victims. The toolkit is Rust-based, complicating static detection because binaries are larger, cross-compiled, and less signature-rich than common C# or C++ stealers. Still Sync likely handles staging or synchronization, Still Audio enables microphone capture for eavesdropping, and AquilaRAT provides command execution and interactive operator control. C2 indicators include 213.252.244.123, 159.198.37.74, 23.26.237.250, 23.27.24.30, 145.223.69.143, and 145.223.68.66, plus MD5 samples c1d1ee16b92e6a138ffa048855f75d7d and 17674b250d8b422a50a86c9ff207186d. Persistence is expected through startup entries, scheduled tasks, or disguised donation app components. Espionage behavior includes Telegram data access, audio surveillance, and selective exfiltration from government, technology, and education victims.
Multi-stage phishing relay. Distribution uses phishing links that chain through newly registered domains and trusted infrastructure. Observed infrastructure includes 2934523t5234535323973294afhdsfga.com, alasilla.com, and bl.dase7.shop. URLs use long randomized paths and double extensions, for example .html.html, to evade naive parsers. Payload pages use Blob API redirection smuggling, Web Crypto API decryption, and device-code phishing to steal OAuth tokens or session material rather than only passwords. Persistence is token or session based after consent or device code approval. Anti-analysis includes redirection separation, cloud-hosted workers, randomized paths, crypto-gated pages, and brand impersonation.
IOC Analysis
The pulse set contains IPv4 C2 or staging addresses, domains and hostnames used for extortion infrastructure or phishing relays, URLs with randomized paths and repeated file extensions, CVE-2023-34362 for MOVEit Transfer exposure, and MD5 hashes tied to Armored Likho Still Toolkit samples. SOC teams should ingest indicators into an intel platform with expiry dates and confidence scoring, then route network IOCs to egress firewall, DNS resolver, proxy, and EDR network blocking. File hashes should be added to EDR blocklists and retrohunts, but hash-only coverage is insufficient because Rust droppers and phishing kits mutate quickly.
Operationalize domains by resolving passive DNS, checking newly registered domain age, and alerting on first-seen lookups to bl.dase7.shop, alasilla.com, and 2934523t5234535323973294afhdsfga.com. For URLs, normalize case, strip trailing punctuation such as the stray quote in one OTX URL, and match both full URLs and parent host or path patterns. For CVE-2023-34362, correlate internet-facing MOVEit Transfer inventory, web server logs, authentication anomalies, and unexpected file creation under transfer or web directories. Tooling that decodes these indicators includes SIEM lookup tables, MISP or OTX integrations, DNS RPZ, proxy categorization override, EDR block and allow lists, sandbox detonation for Rust binaries, browser isolation logs for Blob and Crypto API abuse, and identity protection analytics for device-code phishing.
Detection Engineering
---
title: Armored Likho Still Toolkit Rust Espionage Execution
id: 9f2d1a24-0e5b-4f9c-a7a1-armoredlikhostill
status: experimental
description: Detects execution or installation artifacts consistent with Armored Likho Still Toolkit fake donation apps, Still Sync, Still Audio, or AquilaRAT samples observed in OTX pulse data.
author: Security Arsenal
date: 2026/08/13
logsource:
category: process_creation
product: windows
selection_hashes:
Hashes|contains:
- c1d1ee16b92e6a138ffa048855f75d7d
- 17674b250d8b422a50a86c9ff207186d
selection_names:
Image|endswith:
- still_sync.exe
- still_audio.exe
- aquilarat.exe
CommandLine|contains:
- donation
- telegram
- audio
- microphone
condition: selection_hashes or (selection_names and all of selection_names*)
falsepositives:
- Legitimate donation or translation software with similar filenames
level: high
tags:
- attack.initial-access
- attack.collection
- attack.command-and-control
- attack.t1059
- attack.t1123
---
title: Cl0p MFT Exploitation and LEMURLOOT Staging Network Activity
id: 5d9b39a2-2c4a-4f31-b2c9-cl0pmftlemurloot
status: experimental
description: Detects outbound connections from MFT or enterprise application servers to Cl0p-linked IPs or domains and suspicious post-exploit transfer behavior.
author: Security Arsenal
date: 2026/08/13
logsource:
category: network_connection
selection_srcproc:
Image|endswith:
- w3wp.exe
- java.exe
- tomcat9.exe
- moveit.exe
- serv-u.exe
- goanywhere.exe
selection_dst:
DestinationIp:
- 45.129.137.232
- 92.118.36.233
- 200.107.207.26
DestinationHostname|contains:
- pubstorm.com
- pubstorm.net
condition: all of selection_srcproc and selection_dst
falsepositives:
- Rare vendor update traffic if infrastructure is sinkholed or reused
level: critical
tags:
- attack.exfiltration
- attack.command-and-control
- attack.t1190
- attack.t1041
---
title: Multi-Stage Phishing Relay With Randomized Path And HTML Smuggling
id: 7f1e7c31-8b0c-4b8b-9a21-phishrelayblobcrypto
status: experimental
description: Detects proxy or endpoint access to phishing redirection chains using newly registered domains, long randomized paths, double html extensions, or browser Blob and Web Crypto abuse.
author: Security Arsenal
date: 2026/08/13
logsource:
category: proxy
selection_host:
c-uri-host|contains:
- 2934523t5234535323973294afhdsfga.com
- alasilla.com
- bl.dase7.shop
selection_path:
c-uri|contains:
- .html.html
- frontdeskformationdocusignpaywet
- 7tr22673862r7436r20348r6243078r627784608263652874635743209043652603485264350263478023352026
condition: selection_host or selection_path
falsepositives:
- Security research validation or sandbox detonation
level: high
tags:
- attack.initial-access
- attack.phishing
- attack.t1566
- attack.t1027
let Cl0pIPs = dynamic(["45.129.137.232","92.118.36.233","200.107.207.26"]);
let LikhoIPs = dynamic(["213.252.244.123","159.198.37.74","23.26.237.250","23.27.24.30","145.223.69.143","145.223.68.66"]);
let PhishHosts = dynamic(["2934523t5234535323973294afhdsfga.com","alasilla.com","bl.dase7.shop","pubstorm.com","pubstorm.net"]);
union isfuzzy=true
(DeviceNetworkEvents
| where TimeGenerated >= ago(14d)
| where RemoteIP in (Cl0pIPs) or RemoteIP in (LikhoIPs) or RemoteUrl has_any (PhishHosts)
| extend IntelBucket = case(RemoteIP in (Cl0pIPs) or RemoteUrl has_any (dynamic(["pubstorm.com","pubstorm.net"])), "Cl0p/LEMURLOOT", RemoteIP in (LikhoIPs), "ArmoredLikho/StillToolkit", "PhishingRelay")
| project TimeGenerated, IntelBucket, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort, ActionType),
(DeviceProcessEvents
| where TimeGenerated >= ago(14d)
| where MD5 in ("c1d1ee16b92e6a138ffa048855f75d7d","17674b250d8b422a50a86c9ff207186d")
or FileName has_any ("still_sync","still_audio","aquilarat")
or ProcessCommandLine has_any ("donation","telegram","microphone","audio")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, MD5, FolderPath, InitiatingProcessFileName),
(DeviceEvents
| where TimeGenerated >= ago(14d)
| where ActionType has_any ("BrowserLaunchedToOpenUrl","UrlClicked")
| extend ParsedUrl = tostring(AdditionalFields)
| where ParsedUrl has_any (PhishHosts) or ParsedUrl contains ".html.html" or ParsedUrl contains "frontdeskformationdocusignpaywet"
| project TimeGenerated, DeviceName, ActionType, ParsedUrl, InitiatingProcessFileName)
| sort by TimeGenerated desc
# OTX pulse IOC hunt: Cl0p/LEMURLOOT, Armored Likho Still Toolkit, phishing relay artifacts
$ErrorActionPreference = 'SilentlyContinue'
$cl0pIps = '45.129.137.232','92.118.36.233','200.107.207.26'
$likhoIps = '213.252.244.123','159.198.37.74','23.26.237.250','23.27.24.30','145.223.69.143','145.223.68.66'
$badHosts = 'pubstorm.com','pubstorm.net','2934523t5234535323973294afhdsfga.com','alasilla.com','bl.dase7.shop'
$badMd5 = 'c1d1ee16b92e6a138ffa048855f75d7d','17674b250d8b422a50a86c9ff207186d'
Write-Output '[+] Active and recent TCP/UDP connections to OTX indicators'
Get-NetTCPConnection | Where-Object { $cl0pIps + $likhoIps -contains $_.RemoteAddress } | Select-Object LocalAddress,LocalPort,RemoteAddress,RemotePort,State,OwningProcess | Format-Table -AutoSize
Write-Output '[+] Processes with OTX MD5 hashes or Still Toolkit names'
Get-CimInstance Win32_Process | Where-Object {
$_.Name -match 'still_sync|still_audio|aquilarat|donation' -or
$_.CommandLine -match 'telegram|microphone|audio|donation|pubstorm|alasilla|dase7'
} | ForEach-Object {
$hash = (Get-FileHash $_.ExecutablePath -Algorithm MD5).Hash
[PSCustomObject]@{Pid=$_.ProcessId; Name=$_.Name; Path=$_.ExecutablePath; MD5=$hash.ToLower(); OtxHashMatch=($badMd5 -contains $hash.ToLower()); CommandLine=$_.CommandLine}
} | Format-List
Write-Output '[+] Persistence locations for fake donation apps and Still Toolkit'
$runKeys = 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run','HKCU:\Software\Microsoft\Windows\CurrentVersion\Run','HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce','HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce'
foreach ($k in $runKeys) {
Get-ItemProperty $k | ForEach-Object { $_.PSObject.Properties } | Where-Object { $_.Value -match 'still_sync|still_audio|aquilarat|donation|telegram|audio' } | Select-Object @{n='Key';e={$k}}, Name, Value
}
Get-ScheduledTask | Where-Object { $_.TaskName -match 'still|donat|aquila|audio|sync' -or $_.Actions.Execute -match 'still_sync|still_audio|aquilarat' } | Select-Object TaskName,TaskPath,State,@{n='Action';e={$_.Actions.Execute}}
Write-Output '[+] DNS client cache hits for phishing and C2 domains'
Get-DnsClientCache | Where-Object { $badHosts | ForEach-Object { $_ -and ($entry=$_) ; $_.Name -like "*$entry*" } } | Select-Object Name,Type,TimeToLive,Data | Format-Table -AutoSize
Write-Output '[+] MFT and web edge log hints for CVE-2023-34362 review'
$webRoots = 'C:\inetpub\logs','C:\Program Files\MOVEit','C:\Program Files\SolarWinds','C:\Program Files\Fortra','C:\GoAnywhere'
foreach ($root in $webRoots) {
if (Test-Path $root) {
Get-ChildItem $root -Recurse -Include *.log,*.txt -ErrorAction SilentlyContinue | Select-String -Pattern 'CVE-2023-34362|Human.aspx|moveitisapi|guestaccess|/api/v1/token|machine2.aspx' -List | Select-Object Path,LineNumber,Line
}
}
Response Priorities
- Immediate: Block listed IPs, domains, hostnames, URLs, and MD5 hashes at EDR, DNS, proxy, and egress controls. Search for connections to pubstorm infrastructure from MFT, web, Java, IIS, Serv-U, GoAnywhere, or MOVEit processes. Isolate any host with Still Toolkit MD5s or process names, and capture memory before shutdown because Rust espionage tools may leave limited disk artifacts.
- 24h: If credential, token, Telegram, or device-code phishing exposure is possible, force password resets, revoke OAuth grants, invalidate refresh tokens, require phishing-resistant MFA re-registration, and review inbox rules and consent grants. For Cl0p exposure, confirm whether MFT data stores were enumerated, downloaded, or staged, and preserve edge appliance logs before rotation.
- 1 week: Patch or isolate MOVEit Transfer and review all internet-facing file transfer and enterprise application assets for CVE-2023-34362 and related Cl0p-targeted flaws. Restrict outbound traffic from MFT servers to approved destinations, disable unnecessary microphone permissions for standard users, add browser isolation for uncategorized newly registered domains, detect Blob and Web Crypto phishing patterns, and segment donation-style or Telegram-linked application installs away from privileged users.
Related Resources
Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.