ClickFix AS202412 Infostealer Chains + Red Heron WordPress Raids: OTX Detection Pack for DarkGate, Amadey, Matanbuchus

Threat Summary

Two pulses describe complementary credential-theft risk rather than a single intrusion. The first reports four malicious chains over five months using the same Seychelles bulletproof host, AS202412 / OMEGATECH LTD. Delivery starts with fake CAPTCHA pages and ClickFix social engineering: victims are told to paste commands into the Windows Run dialog. Infrastructure rotates disposable domains across .shop, .sbs, .beer and compromised sites, while durable hosting keeps payloads reachable. Families named include DarkGate, Matanbuchus, Amatera, Wacatac and Amadey, with tags indicating trojanized installers, blockchain C2 / EtherHiding and fake CAPTCHA lures.

The second pulse attributes May-September 2026 exploitation to a suspected Chinese-speaking actor linked to Red Heron, operating UTC+8 and repeatedly using 104.225.153.141. The actor targeted WordPress, ZyXEL and enterprise platforms; the most severe incident stole more than 18,000 government records through WordPress exploitation. Together these pulses show initial access by user-assisted execution and edge/CMS exploitation, followed by credential harvesting, data theft and likely resale or espionage enablement.

Threat Actor / Malware Profile

Red Heron activity is patient and infrastructure-frugal: persistent reuse of one IPv4 address, broad country targeting, government and technology focus, and CVE-driven exploitation against public-facing CMS and network devices. The listed indicators include CVE-2022-0847 and multiple 2026 CVEs; treat the exact CVE-to-product mapping as pulse-supplied until validated against your asset inventory. Expected post-exploitation behavior includes webshell deployment, plugin/theme tampering, database export, and collection of WordPress credentials that can seed later credential-stuffing or dark web credential offers.

The AS202412 chains are loader/stealer adjacent. ClickFix converts the victim into the installer: explorer.exe launches Run-dialog commands that invoke powershell.exe, mshta.exe, rundll32.exe, cmd.exe, curl.exe or similar LOLBins. Payloads then establish staging via disposable domains, compromised sites, CDN-looking hostnames, and in some chains blockchain-based C2 resolution or EtherHiding-style dead drops. Persistence commonly lands in Run keys, scheduled tasks, startup folders, or user-level COM/URL handlers. Anti-analysis includes short-lived domains, benign-looking CAPTCHA/CDN names, encoded PowerShell, process injection, and separation between throwaway front-end domains and durable backend hosting.

IOC Analysis

Indicator types are domains, IPv4, and CVEs; file hashes are not included in the sample. Operationalize domains such as alianzeg.shop, newtdsone.shop, ai-nexora.sbs, cdn-2faclov.sbs, lcates-vs.beer, capcha-cdn-js.beer, cdn-plugin-js.beer and carrotbunnies.com through DNS sinkholing, proxy categorization, TLS SNI inspection, and retro-hunts in DNS, proxy, EDR network and email/browser telemetry. Treat .shop/.sbs/.beer look-alikes and CAPTCHA/CDN naming as high-signal when paired with Run-dialog execution.

For Red Heron, block and hunt 104.225.153.141, but prioritize behavior because the actor reused one IP across months. Enrich CVEs with internet exposure, WordPress plugin/theme inventory, WAF logs, ZyXEL management-plane exposure and authentication anomalies. Recommended tooling: EDR process lineage for ClickFix, DNS RPZ/Sinkhole and passive DNS for disposable domains, GreyNoise/OTX context for scanning versus exploitation, WAF/ModSecurity or CMS integrity monitoring for WordPress, and Sentinel/Defender advanced hunting for correlation.

Detection Engineering

YAML

---
title: ClickFix Fake CAPTCHA Run Dialog Execution
id: 7a4f1b2e-9c1d-4f62-b7d8-otxclickfix001
status: experimental
description: Detects user-assisted execution consistent with ClickFix/fake CAPTCHA chains where explorer.exe spawns command interpreters or LOLBins after a Run dialog paste action.
author: Security Arsenal
references:
  - https://otx.alienvault.com
date: 2026/09/23
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\explorer.exe'
  selection_child_img:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\cmd.exe'
      - '\curl.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  selection_cl:
    CommandLine|contains:
      - ' -enc'
      - ' -e '
      - 'EncodedCommand'
      - 'iex'
      - 'Invoke-Expression'
      - 'downloadstring'
      - 'mshta http'
      - 'rundll32 url.dll'
      - 'javascript:'
      - 'capcha'
      - 'captcha'
  filter_known_admin:
    CommandLine|contains:
      - 'Microsoft.Windows.AutoPilot'
      - 'ManageEngine'
      - 'SCCM'
  condition: selection_parent and selection_child_img and selection_cl and not 1 of filter_known_admin
falsepositives:
  - Admin troubleshooting using Run dialog
  - Software deployment tools invoking encoded PowerShell interactively
level: high
tags:
  - attack.execution
  - attack.t1059
  - attack.t1204
  - attack.t1218
---
title: AS202412 ClickFix Disposable Domain DNS or TLS Contact
id: 51d8c6aa-2c8c-4e2b-9fd6-otxas202412dns
status: experimental
description: Detects DNS queries or TLS server name contact to disposable ClickFix/loader domains observed in OTX pulse infrastructure on AS202412.
author: Security Arsenal
references:
  - https://otx.alienvault.com
date: 2026/09/23
logsource:
  category: dns
  product: windows
detection:
  selection_domains:
    QueryName|contains:
      - 'alianzeg.shop'
      - 'newtdsone.shop'
      - 'ai-nexora.sbs'
      - 'cdn-2faclov.sbs'
      - 'lcates-vs.beer'
      - 'capcha-cdn-js.beer'
      - 'cdn-plugin-js.beer'
      - 'carrotbunnies.com'
  selection_tlds_suspicious:
    QueryName|endswith:
      - '.shop'
      - '.sbs'
      - '.beer'
  selection_names:
    QueryName|contains:
      - 'capcha'
      - 'captcha'
      - 'cdn-'
      - 'plugin-js'
      - '2fac'
      - 'nexora'
  condition: selection_domains or (selection_tlds_suspicious and selection_names)
falsepositives:
  - Rare legitimate small business domains using low-cost TLDs
level: medium
tags:
  - attack.command_and_control
  - attack.t1071.001
  - attack.t1568
---
title: Red Heron Repeated IPv4 Contact or Web Process Child Shell
id: 8db1b90c-8e21-43d4-bf10-otxredheronwp
status: experimental
description: Detects connections to Red Heron associated IPv4 104.225.153.141 and suspicious shell/script child processes under web or CMS services after exploitation.
author: Security Arsenal
references:
  - https://otx.alienvault.com
date: 2026/09/23
logsource:
  category: process_creation
  product: windows
detection:
  selection_web_parent:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\php-cgi.exe'
      - '\php.exe'
      - '\nginx.exe'
      - '\httpd.exe'
      - '\apache.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  selection_cl:
    CommandLine|contains:
      - '104.225.153.141'
      - 'wp-content'
      - 'wp-config'
      - 'mysqldump'
      - 'whoami'
      - 'net user'
      - 'certutil -decode'
      - 'downloadstring'
  condition: selection_web_parent and selection_child and selection_cl
falsepositives:
  - CMS backup plugins
  - Legitimate WordPress WP-CLI administration
level: high
tags:
  - attack.execution
  - attack.t1059
  - attack.t1190
  - attack.t1505.003

KQL — Microsoft Sentinel / Defender

let ClickFixDomains = dynamic(['alianzeg.shop','newtdsone.shop','ai-nexora.sbs','cdn-2faclov.sbs','lcates-vs.beer','capcha-cdn-js.beer','cdn-plugin-js.beer','carrotbunnies.com']);
let RedHeronIPs = dynamic(['104.225.153.141']);
let NameHints = dynamic(['capcha','captcha','cdn-','plugin-js','2fac','nexora','clickfix']);
union isfuzzy=true
(DeviceNetworkEvents
| where Timestamp > ago(14d)
| where RemoteUrl has_any (ClickFixDomains) or RemoteIP in (RedHeronIPs) or (RemoteUrl has_any (NameHints) and RemoteUrl endswith '.shop' or RemoteUrl endswith '.sbs' or RemoteUrl endswith '.beer')
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort, ActionType),
(DeviceProcessEvents
| where Timestamp > ago(14d)
| where InitiatingProcessFileName =~ 'explorer.exe'
| where FileName in~ ('powershell.exe','pwsh.exe','mshta.exe','rundll32.exe','cmd.exe','curl.exe','wscript.exe','cscript.exe')
| where ProcessCommandLine has_any (' -enc',' -e ','EncodedCommand','iex','Invoke-Expression','downloadstring','mshta http','javascript:','capcha','captcha')
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256),
(DeviceProcessEvents
| where Timestamp > ago(14d)
| where InitiatingProcessFileName in~ ('w3wp.exe','php-cgi.exe','php.exe','nginx.exe','httpd.exe','apache.exe')
| where FileName in~ ('cmd.exe','powershell.exe','pwsh.exe','certutil.exe','bitsadmin.exe','rundll32.exe')
| where ProcessCommandLine has_any ('wp-content','wp-config','mysqldump','whoami','net user','104.225.153.141','certutil -decode','downloadstring')
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256)
| summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), Hits=count() by DeviceName, FileName, RemoteIP, RemoteUrl, ProcessCommandLine, InitiatingProcessFileName
| order by LastSeen desc

PowerShell

# Read-only host hunt for ClickFix AS202412 + Red Heron artifacts
$domains = 'alianzeg.shop','newtdsone.shop','ai-nexora.sbs','cdn-2faclov.sbs','lcates-vs.beer','capcha-cdn-js.beer','cdn-plugin-js.beer','carrotbunnies.com'
$badIp = '104.225.153.141'
Write-Host '[+] RunMRU / Win+R pasted command history'
Get-ItemProperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU' -ErrorAction SilentlyContinue |
  ForEach-Object { $_.PSObject.Properties } |
  Where-Object { $_.Name -ne 'MRUList' -and ($_.Value -match 'powershell|pwsh|mshta|rundll32|cmd|curl|javascript:|captcha|capcha|http') } |
  Select-Object Name, Value
Write-Host '[+] DNS cache hits for disposable domains'
Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object { $n=$_.Entry; $domains | ForEach-Object { $n -like "*$_*" } } | Select-Object Entry, Data, TimeToLive
Write-Host '[+] Active or recent TCP connections to Red Heron IP'
Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object { $_.RemoteAddress -eq $badIp } | Select-Object LocalAddress,LocalPort,RemoteAddress,RemotePort,State,OwningProcess,@{n='Process';e={(Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName}}
Write-Host '[+] Suspicious user-level persistence locations'
$paths = @("$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup","$env:TEMP","$env:LOCALAPPDATA\Temp")
Get-ChildItem $paths -Recurse -File -ErrorAction SilentlyContinue | Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) -and ($_.Name -match 'captcha|capcha|cdn|plugin|update|install|setup' -or $_.Extension -in '.ps1','.js','.hta','.vbs','.bat','.lnk') } | Select-Object FullName, Length, CreationTime, LastWriteTime
Write-Host '[+] Run keys and scheduled tasks with web/encoded actions'
Get-ItemProperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run','HKLM:\Software\Microsoft\Windows\CurrentVersion\Run' -ErrorAction SilentlyContinue | Out-String | Select-String -Pattern 'powershell|mshta|rundll32|curl|http|capcha|captcha' -AllMatches
Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object { ($_.Actions.Execute -match 'powershell|mshta|rundll32|curl|wscript|cscript') -or ($_.Actions.Arguments -match ' -enc|EncodedCommand|http|capcha|captcha|downloadstring') } | Select-Object TaskName, TaskPath, @{n='Action';e={($_.Actions.Execute + ' ' + $_.Actions.Arguments)}}

Response Priorities

Immediate: block the listed domains and 104.225.153.141 at DNS, proxy, firewall and EDR network controls; sinkhole rather than only deny where possible to identify impacted hosts. Hunt the last 14-30 days for explorer-to-interpreter process chains, RunMRU artifacts, DNS cache entries, web-server child shells and WordPress file changes. Isolate hosts with ClickFix execution plus matching domain contact.
24h: because infostealer and CMS database theft imply credential exposure, force password resets for affected users, revoke sessions and OAuth tokens, rotate WordPress admin/database/API secrets, check MFA fatigue or impossible travel, and search identity logs for reuse of harvested cookies/tokens. Treat government or technology accounts as priority identity incidents.
1 week: reduce Run-dialog/LOLBin abuse with WDAC/AppLocker or attack surface reduction rules, constrain PowerShell for standard users, block uncategorized low-reputation TLDs where business allows, add browser isolation for unknown CAPTCHA/CDN prompts, put WordPress behind WAF/virtual patching, remove public ZyXEL management exposure, and establish CMS file-integrity plus plugin allowlisting.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub