This week's OTX telemetry paints a coherent picture of a threat landscape dominated by two converging trends: the industrialization of social-engineering-driven malware delivery, and aggressive state-aligned exploitation of unpatched browser, OS, and web-application vulnerabilities.
Campaign 1 — Bulletproof ClickFix Infrastructure (AS202412 / OMEGATECH LTD): Over five months, four distinct malware delivery chains — pushing DarkGate, Matanbuchus, Amatera, Wacatac, and Amadey — operated through the same bulletproof hosting provider registered in Seychelles. Every chain began with a fake CAPTCHA page using the ClickFix technique, instructing victims to paste malicious commands into the Windows Run dialog. Notably, at least one chain leveraged EtherHiding (blockchain-based C2 resolution), a technique we previously associated with North Korean activity, now being commoditized for commodity loaders. Domains are disposable and pattern-consistent (.shop, .sbs, .beer TLDs); the hosting layer is durable.
Campaign 2 — UTA0565 (Chinese APT) Zero-Day Operations: Volexity-attributed actor UTA0565 exploited CVE-2026-85046 / CVE-2026-85880 (Chrome RCE) and CVE-2026-87491 (Windows privilege escalation) via phishing emails directing Asian government, NGO, and media targets to fake domains impersonating China Digital Times and the Center for American Progress (note the typosquats: americanprgoress.top, chinadigitaltimes.top, thecovnresation.net). The payload, CLEANGULP, is deployed post-exploitation for persistence and collection.
Campaign 3 — Red Heron 'Kapibala' Mass Exploitation: A Chinese-speaking actor operating from UTC+8 ran a five-month exploitation campaign from a single IP (104.225.153.141) against WordPress, ZyXEL switches, and enterprise platforms across 50+ countries. In the most severe incident, over 18,000 government records were stolen via WordPress exploitation. CVE coverage spans legacy (CVE-2022-0847 Dirty Pipe) to 2026-dated WordPress/plugin flaws — a classic patch-gap harvest.
Collective assessment: Organizations face simultaneous exposure at three layers — end-user social engineering (ClickFix), browser/OS zero-days (UTA0565), and perimeter web applications (Red Heron). All three campaigns disproportionately target government and NGO entities but the loader infrastructure is indiscriminate.
Threat Actor / Malware Profile
ClickFix Loader Cluster (DarkGate, Matanbuchus, Amatera, Amadey, Wacatac)
- Distribution: Fake CAPTCHA verification pages on compromised legitimate sites and disposable domains. ClickFix instructs the victim to press
Win+Rand paste a clipboard-injected command — typically amshta.exeorpowershell.exeone-liner retrieving a second-stage payload. This bypasses email gateways and most perimeter controls entirely because the user executes the command. - Payload behavior: DarkGate operates as a loader/RAT with AutoIt-based staging, keylogging, credential theft, and VNC capability. Matanbuchus and Amadey function as loader-as-a-service frameworks pulling follow-on payloads (stealers, ransomware precursors). Amatera is a stealer-focused family; Wacatac (S1025) is a broad trojan classification often associated with packed loaders.
- C2 communication: Standard HTTPS beaconing to rotated domains, augmented in at least one chain by EtherHiding — C2 configuration stored in smart contracts on public blockchains (BSC/Ethereum), making takedown nearly impossible since the blockchain itself cannot be seized.
- Persistence: Registry Run keys, scheduled tasks, and (DarkGate) startup folder LNK files.
- Anti-analysis: User-execution requirement defeats sandbox detonation (no automated system presses Win+R). Multi-stage packing, AutoIt obfuscation, disposable front-end domains decoupled from durable bulletproof backends.
UTA0565 / CLEANGULP
- Distribution: Spear-phishing against Asian government entities, NGOs, and media using impersonated legitimate organizations.
- Exploitation: Chrome renderer RCE (CVE-2026-85046/85880 chain) escaped via Windows privilege escalation (CVE-2026-87491) — a full drive-by chain requiring only that the victim visit the fake site on an unpatched browser/OS.
- Payload behavior (CLEANGULP): Post-exploitation implant focused on persistence, credential access, and staged collection aligned with state-level intelligence requirements.
Red Heron (Kapibala Campaign)
- Distribution: Opportunistic mass scanning and exploitation from a single persistent IP — noisy but effective.
- Behavior: WordPress plugin/theme vulnerability exploitation (CVE-2026-34908/09/10, CVE-2026-54391-class flaws), webshell deployment, database exfiltration; lateral interest in ZyXEL network devices for persistence beyond the web tier.
- Profile: UTC+8 working hours, Chinese-language tooling artifacts, sustained single-IP operations suggesting either confidence in infrastructure or limited OPSEC requirements for the target set.
IOC Analysis
Indicator composition across the three pulses:
- Domains (dominant type): The ClickFix cluster contributes pattern-consistent disposable domains on cheap TLDs (
.shop,.sbs,.beer). Rather than blocking only listed domains, SOC teams should implement regex/pattern detection for the naming convention and treat resolution of ANY.sbs/.beerTLD from an endpoint as a hunt-worthy anomaly in most enterprises. The UTA0565 domains are typosquats — enrichment against legitimate brand domains (chinadaily,americanprogress) with Levenshtein-distance scoring catches the pattern class. - IPv4 (single): 104.225.153.141 (AS25820) — the Red Heron exploitation source. Block at egress and search ingress logs (web server logs, WAF) for this IP against WordPress and ZyXEL attack surface.
- CVEs (11+): These are detection-and-patching pivots, not blockable IOCs. CVE-2022-0847 presence in a 2026 campaign confirms Red Heron exploits long-tail unpatched assets — vulnerability scan data should be cross-referenced against the full CVE list.
Operationalization guidance:
- Ingest OTX pulses via the OTX DirectConnect API or TAXII into your SIEM/TIP; AlienVault OTX integrates natively with Sentinel, Splunk ES, and MISP.
- Domain IOCs → DNS sinkhole/proxy block + retroactive DNS log hunt (90 days minimum given the five-month campaign duration).
- CVE IOCs → feed to your VM platform (Qualys/Tenable/Defender TVM) as a priority scan policy.
- EtherHiding note: Traditional domain blocking is partially ineffective against blockchain-resolved C2. Detect the behavior instead: endpoints making JSON-RPC calls to public BSC/Ethereum nodes (
bsc-dataseed.binance.org,eth.llamarpc.com, etc.) that are not sanctioned Web3 applications.
Detection Engineering
YAML
---
title: ClickFix Fake CAPTCHA Run Dialog Execution - Suspicious mshta/powershell Child of Explorer
id: 9f3a1c2e-7b4d-4e5a-8c6f-2d1e9a0b3c4d
status: experimental
description: Detects ClickFix-style user-executed commands where mshta, powershell, or curl is launched directly from explorer.exe (Run dialog) with remote content retrieval — consistent with DarkGate/Matanbuchus/Amatera/Amadey delivery chains observed on AS202412 bulletproof hosting.
author: Security Arsenal Threat Intelligence
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith: '\explorer.exe'
selection_child:
Image|endswith:
- '\mshta.exe'
- '\powershell.exe'
- '\pwsh.exe'
- '\curl.exe'
- '\rundll32.exe'
selection_cmd:
CommandLine|contains:
- 'http://'
- 'https://'
- 'Invoke-Expression'
- 'IEX'
- 'DownloadString'
- 'ms-its'
- '.sbs'
- '.beer'
- '.shop'
condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Rare legitimate IT admin one-liners run via Run dialog
level: high
date: 2026/09/23
tags:
- attack.t1204
- attack.t1204.004
- attack.t1059
- attack.t1105
---
title: EtherHiding Blockchain RPC C2 Resolution from Endpoint
id: 7c2d4e8a-1f6b-4a3c-9d5e-8b7a6c5d4e3f
status: experimental
description: Detects non-browser processes making JSON-RPC calls to public blockchain RPC endpoints, consistent with EtherHiding C2 configuration retrieval observed in ClickFix-delivered malware chains on AS202412 infrastructure.
author: Security Arsenal Threat Intelligence
logsource:
category: network_connection
product: windows
detection:
selection_host:
DestinationHostname|contains:
- 'bsc-dataseed'
- 'binance.org'
- 'llamarpc'
- 'publicnode.com'
- 'ankr.com'
- 'infura.io'
- 'alchemy.com'
selection_proc:
Image|endswith:
- '\powershell.exe'
- '\mshta.exe'
- '\rundll32.exe'
- '\regsvr32.exe'
- '\wscript.exe'
- '\cscript.exe'
condition: selection_host and selection_proc
falsepositives:
- Legitimate Web3/crypto tooling (rare on enterprise endpoints)
level: high
date: 2026/09/23
tags:
- attack.t1071.001
- attack.t1102
- attack.s1025
---
title: WordPress Exploitation - Web Server Spawning Shell or Download Tools
id: 3e8f1a9b-5c7d-4e2f-8a1b-6c9d0e2f4a5b
status: experimental
description: Detects web server processes (php-cgi, w3wp, apache, nginx) spawning command shells or download utilities — consistent with Red Heron Kapibala WordPress exploitation and webshell deployment activity.
author: Security Arsenal Threat Intelligence
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- '\php-cgi.exe'
- '\php.exe'
- '\w3wp.exe'
- '\httpd.exe'
selection_child:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
- '\certutil.exe'
- '\bitsadmin.exe'
- '\curl.exe'
- '\whoami.exe'
- '\net.exe'
condition: selection_parent and selection_child
falsepositives:
- WordPress plugins legitimately invoking system commands (uncommon — investigate all hits)
level: critical
date: 2026/09/23
tags:
- attack.t1190
- attack.t1505.003
- attack.t1059
KQL — Microsoft Sentinel / Defender
// Hunt: ClickFix execution, EtherHiding RPC, UTA0565 typosquats, Red Heron source IP
// Microsoft Sentinel / Defender XDR — 90-day lookback aligned to campaign duration
let clickfix_domains = dynamic(["alianzeg.shop","newtdsone.shop","ai-nexora.sbs","cdn-2faclov.sbs","lcates-vs.beer","capcha-cdn-js.beer","cdn-plugin-js.beer","carrotbunnies.com"]);
let uta0565_domains = dynamic(["halal-navi.net","outsourcingwise.net","halaltak.net","personclouds.com","americanprgoress.top","chinadigitaltimes.top","thecovnresation.net"]);
let blockchain_rpc = dynamic(["bsc-dataseed","llamarpc","publicnode.com","ankr.com","infura.io"]);
let suspicious_tlds = dynamic([".sbs",".beer"]);
union isfuzzy=true
(DeviceNetworkEvents
| where TimeGenerated > ago(90d)
| where RemoteUrl in~ (clickfix_domains) or RemoteUrl in~ (uta0565_domains) or RemoteIP == "104.225.153.141"
or (RemoteUrl has_any (blockchain_rpc) and InitiatingProcessFileName in~ ("powershell.exe","mshta.exe","rundll32.exe","wscript.exe"))
or (RemoteUrl endswith any (suspicious_tlds))
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, ActionType),
(DeviceProcessEvents
| where TimeGenerated > ago(90d)
| where InitiatingProcessFileName =~ "explorer.exe"
and FileName in~ ("mshta.exe","powershell.exe","curl.exe","rundll32.exe")
and ProcessCommandLine has_any ("http://","https://","IEX","DownloadString",".sbs",".beer")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, AccountName)
| sort by TimeGenerated desc
PowerShell
# ClickFix / DarkGate / Red Heron endpoint hunt — run via EDR live response or GPO startup
# Checks persistence artifacts, Run-dialog execution traces, and network indicators
$ErrorActionPreference = 'SilentlyContinue'
$findings = @()
# 1) RunMRU: ClickFix victims leave the pasted command in Run dialog history
$mru = Get-ItemProperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU'
$mru.PSObject.Properties | Where-Object { $_.Value -match 'mshta|powershell|curl|iex|\.sbs|\.beer|\.shop' } | ForEach-Object {
$findings += "[RunMRU-ClickFix] $($_.Name): $($_.Value)"
}
# 2) Persistence: Run keys with LOLBins or suspicious script paths
$runKeys = @(
'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run',
'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run',
'HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce'
)
foreach ($k in $runKeys) {
Get-ItemProperty $k | ForEach-Object {
$_.PSObject.Properties | Where-Object { $_.Value -match 'mshta|powershell.*-(e|ec|enc)|AppData.*\.ps1|AppData.*\.vbs|Temp.*\.bat' } | ForEach-Object {
$findings += "[Persistence] $k :: $($_.Name) = $($_.Value)"
}
}
}
# 3) DarkGate-style AutoIt staging in user-writable paths
$stagingPaths = @("$env:APPDATA","$env:LOCALAPPDATA\Temp","$env:ProgramData")
foreach ($p in $stagingPaths) {
Get-ChildItem $p -Recurse -Include '*.au3','AutoIt3.exe','*.a3x' -Depth 3 | ForEach-Object {
$findings += "[DarkGate-AutoIt] $($_.FullName) (Modified: $($_.LastWriteTime))"
}
}
# 4) Active connections to known-bad infra (Red Heron) and disposable-TLD resolution cache
$badConns = Get-NetTCPConnection -State Established | Where-Object { $_.RemoteAddress -eq '104.225.153.141' }
$badConns | ForEach-Object {
$proc = Get-Process -Id $_.OwningProcess
$findings += "[Network-RedHeron] PID $($_.OwningProcess) ($($proc.ProcessName)) -> $($_.RemoteAddress):$($_.RemotePort)"
}
$dnsHits = Get-DnsClientCache | Where-Object { $_.Entry -match '\.(sbs|beer|shop)$|chinadigitaltimes|americanprgoress|thecovnresation|halal-navi|halaltak' }
$dnsHits | ForEach-Object { $findings += "[DNS-IOC] $($_.Entry) -> $($_.Data)" }
# 5) Scheduled tasks with script interpreters (DarkGate/Amadey persistence)
Get-ScheduledTask | Where-Object { $_.Actions.Execute -match 'powershell|mshta|wscript|rundll32' } | ForEach-Object {
$findings += "[SchedTask] $($_.TaskName) :: $($_.Actions.Execute) $($_.Actions.Arguments)"
}
if ($findings.Count -gt 0) {
$findings | Out-File "$env:TEMP\clickfix_hunt_$(Get-Date -Format yyyyMMdd_HHmm).txt"
Write-Output "[!] $($findings.Count) finding(s) — review output file in TEMP"; $findings
} else {
Write-Output "[+] No ClickFix/DarkGate/Red Heron artifacts found on $env:COMPUTERNAME"
}
Response Priorities
Immediate (0–4 hours):
- Block all listed domains at DNS/proxy layer; add wildcard or alerting rules for
.sbsand.beerTLD resolution from endpoints. - Block and retro-hunt ingress/egress traffic involving 104.225.153.141 — including web server and WAF logs for WordPress attack surface.
- Push the Run-dialog execution Sigma rule to production; ClickFix entirely bypasses perimeter controls, so endpoint behavioral detection is your primary control.
- Verify Chrome and Windows patch posture against CVE-2026-85046, CVE-2026-85880, and CVE-2026-87491 — emergency patch for internet-facing users and high-risk government/NGO personas.
24 hours:
- For any host with a ClickFix execution hit: force enterprise-wide credential reset for that user — DarkGate and Amadey both steal browser-stored credentials, session cookies, and VPN tokens within minutes of execution. Revoke active sessions (Entra ID/Okta) and invalidate refresh tokens.
- Audit WordPress estates: enumerate plugins/themes, cross-reference against the CVE list (CVE-2026-34908/09/10, CVE-2026-54391, CVE-2026-60004, CVE-2026-60137, CVE-2026-63030, CVE-2026-7273), and check
wp-content/uploadsfor webshells (PHP files with recent modification times). - Government, NGO, and media organizations: review inbound email for UTA0565 lures referencing China Digital Times / Center for American Progress impersonation and search proxy logs for the typosquat domains.
1 week:
- Disable or restrict the Windows Run dialog and mshta.exe for standard users via AppLocker/WDAC — ClickFix collapses without user-executable LOLBins. At minimum, apply an ASR rule blocking Office and script-interpreter child processes.
- Deploy WAF virtual patching for the WordPress CVE set and place ZyXEL management interfaces behind VPN-only access (they should never be internet-exposed).
- Implement blockchain-RPC egress policy: restrict outbound JSON-RPC to public crypto nodes to sanctioned applications only.
- Feed AS202412 (OMEGATECH LTD) netblocks into threat-intel blocklists — bulletproof ASNs justify preemptive network-level denial.
- Brief executives on the government-records breach (18,000+ records): if your organization operates public records portals on WordPress, conduct a targeted compromise assessment now.
Related Resources
Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.