ClickFix macOS Campaigns, Remus Browser Bypass, and Gamaredon GammaSteel Espionage: OTX Pulse Intelligence

---
title: Potential GammaSteel Persistence via Printers Registry
id: 0e8f1c12-1234-5678-9101-abcdef123456
description: Detects suspicious modifications or creation of keys/values under HKCU\Printers often associated with Gamaredon GammaSteel malware persistence.
status: experimental
author: Security Arsenal
date: 2026/06/08
references:
    - https://otx.alienvault.com/
tags:
    - attack.persistence
    - attack.defense_evasion
    - attack.t1112
logsource:
    product: windows
    category: registry_set
detection:
    selection:
        TargetObject|contains: 'Printers'
        Details|contains: 'powershell' # Generic heuristic for payload content
    condition: selection
falsepositives:
    - Legitimate printer driver installations (rare in HKCU)
level: high
---
title: Remus Stealer Browser Credential Access Attempt
id: 1b9g2d23-2345-6789-0123-bcdefg234567
description: Detects behavior indicative of information stealers attempting to access browser data or bypass application-bound encryption.
status: experimental
author: Security Arsenal
date: 2026/06/08
references:
    - https://otx.alienvault.com/
tags:
    - attack.credential_access
    - attack.collection
    - attack.t1005
logsource:
    product: windows
    category: file_access
detection:
    selection:
        TargetFilename|contains:
            - '\\Local State'
            - '\\Login Data'
            - '\\Cookies'
    filter:
        Image|contains: '\\Program Files\\'
    condition: selection and not filter
falsepositives:
    - Legitimate browser backup or debugging tools
level: medium
---
title: ClickFix macOS Terminal Download Pattern
id: 2c0h3e34-3456-7890-1234-cdefgh345678
description: Detects the execution of suspicious curl/chmod commands often seen in ClickFix campaigns targeting macOS.
status: experimental
author: Security Arsenal
date: 2026/06/08
references:
    - https://otx.alienvault.com/
tags:
    - attack.initial_access
    - attack.execution
    - attack.t1059.004
logsource:
    product: macos
    category: process_creation
detection:
    selection:
        Image|endswith: '/bin/bash'
        CommandLine|contains: 'curl'
        CommandLine|contains: 'chmod +x'
    condition: selection
falsepositives:
    - System administration scripts
level: high


kql
// Hunt for Gamaredon GammaSteel Registry Persistence
DeviceRegistryEvents
| where RegistryKey contains @"HKEY_CURRENT_USER\Printers"
| where ActionType == "RegistryKeyCreated" or ActionType == "RegistryValueSet"
| project Timestamp, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessAccountName

// Hunt for network connections to known ClickFix or Gamaredon IOCs
DeviceNetworkEvents
| where RemoteUrl in~ ("jihiz.com", "kayeart.com", "bintail.com", "wusetail.com", "malext.com", "miappl.com", "pla7ina.cfd", "vagturk.com", "justsstop.ru") or RemoteIP == "165.22.170.129"
| project Timestamp, DeviceName, RemoteUrl, RemoteIP, RemotePort, InitiatingProcessFileName

// Hunt for suspicious process execution patterns (Remus/Generic Stealer)
DeviceProcessEvents
| where ProcessCommandLine has "Local State" or ProcessCommandLine has "Login Data"
| where FileName in~ ("powershell.exe", "cmd.exe", "cscript.exe")
| project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName


powershell
# PowerShell Hunt Script for GammaSteel Registry Artifacts
# Checks HKCU\Printers for unexpected keys or values containing suspicious content

$ErrorActionPreference = "SilentlyContinue"
$Results = @()

# Check Printers hive
$Path = "HKCU:\Printers"
if (Test-Path $Path) {
    $Keys = Get-ChildItem -Path $Path -Recurse -ErrorAction SilentlyContinue
    foreach ($Key in $Keys) {
        # GammaSteel often stores payloads here
        if ($Key.Name -like "*Printers*") {
            $Values = Get-ItemProperty -Path $Key.PSPath -ErrorAction SilentlyContinue
            foreach ($Prop in $Values.PSObject.Properties) {
                if ($Prop.Name -ne "PSPath" -and $Prop.Name -ne "PSParentPath" -and $Prop.Name -ne "PSChildName") {
                    $ValueData = $Prop.Value
                    # Heuristic: Look for Base64 or executable-like strings in registry data
                    if ($ValueData -match "[a-zA-Z0-9+/]{50,}={0,2}" -or $ValueData -match "MZ") {
                        $Results += [PSCustomObject]@{
                            Timestamp = Get-Date
                            Hostname  = $env:COMPUTERNAME
                            Path      = $Key.Name
                            Name      = $Prop.Name
                            Data      = $ValueData.Substring(0, [Math]::Min(100, $ValueData.Length)) + "..."
                            Risk      = "High"
                        }
                    }
                }
            }
        }
    }
}

if ($Results) {
    $Results | Format-Table -AutoSize
    Write-Host "Potential GammaSteel artifacts found. Investigate registry keys immediately." -ForegroundColor Red
} else {
    Write-Host "No obvious GammaSteel persistence artifacts found in HKCU\Printers." -ForegroundColor Green
}