ClingSTUN Proxy Backdoor + Fake MP4 NetSupport Loader: OTX Pulse Analysis — Edge Device Hijacking & Encrypted RAT Delivery

---
title: Suspicious MP4 Download Followed by PowerShell Execution - Fake MP4 NetSupport Chain
id: 9f2c1a44-7b31-4e58-9a1d-clingstun001
status: experimental
description: Detects PowerShell download cradles retrieving .mp4 files from suspicious domains or bare IPs, consistent with the fake MP4 NetSupport Manager delivery chain observed in OTX pulses.
author: Security Arsenal Threat Intelligence
date: 2026/10/17
references:
    - https://censys.com/blog/fake-mp4-file-carries-malicious-payload/
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
    selection_cli:
        CommandLine|contains:
            - '.mp4'
            - 'tzast.mp4'
            - 'approvalrequest-api.com'
            - 'usersecuritycheck.com'
            - 'x2664.com'
            - 'karlenagida.com'
            - '89.34.90.111'
    selection_dl:
        CommandLine|contains:
            - 'Invoke-WebRequest'
            - 'Invoke-RestMethod'
            - 'wget '
            - 'curl '
            - 'DownloadString'
            - 'DownloadFile'
            - 'Start-BitsTransfer'
            - 'certutil'
    condition: selection_img and selection_cli and selection_dl
falsepositives:
    - Legitimate media download scripts (rare in enterprise contexts)
level: high
tags:
    - attack.execution
    - attack.t1059.001
    - attack.command_and_control
    - attack.t1105
---
title: NetSupport Manager Client Execution or Persistence Artifact
id: 7d3e8b21-4c92-4f61-b2e8-clingstun002
status: experimental
description: Detects execution of NetSupport Manager client binaries (client32.exe) from non-standard paths or registry Run-key persistence, indicative of unauthorized RAT installation.
author: Security Arsenal Threat Intelligence
date: 2026/10/17
references:
    - https://censys.com/blog/fake-mp4-file-carries-malicious-payload/
logsource:
    category: process_creation
    product: windows
detection:
    selection_binary:
        Image|endswith:
            - '\client32.exe'
            - '\pcictlui.exe'
            - '\remotelyanywhere.exe'
    filter_legitimate_path:
        Image|startswith:
            - 'C:\Program Files\NetSupport\'
            - 'C:\Program Files (x86)\NetSupport\'
    condition: selection_binary and not filter_legitimate_path
falsepositives:
    - Environments where NetSupport is legitimately deployed outside standard directories
level: high
tags:
    - attack.command_and_control
    - attack.t1219
    - attack.persistence
---
title: Linux Watchdog Manipulation or Proc Concealment - ClingSTUN Behavior
id: 3a91f5c7-8d44-4a29-c7f3-clingstun003
status: experimental
description: Detects Linux commands manipulating watchdog timers, writing to /proc/sys/kernel, or mass process termination consistent with ClingSTUN persistence and anti-analysis on edge devices.
author: Security Arsenal Threat Intelligence
date: 2026/10/17
references:
    - https://blog.polyswarm.io/clingstun-turns-vulnerable-edge-devices-into-attacker-infrastructure?
logsource:
    category: process_creation
    product: linux
detection:
    selection_watchdog:
        CommandLine|contains:
            - '/dev/watchdog'
            - 'watchdog -'
            - 'sysctl -w kernel'
    selection_proc:
        CommandLine|contains:
            - '/proc/sys/kernel'
            - 'mount -o bind'
            - '/proc/self'
    selection_kill:
        CommandLine|contains:
            - 'killall -9'
            - 'pkill -9'
            - 'kill -9 -1'
    condition: 1 of selection_*
falsepositives:
    - Embedded device firmware maintenance scripts
    - Legitimate watchdog configuration by system administrators
level: medium
tags:
    - attack.defense_evasion
    - attack.t1562.001
    - attack.persistence

// Hunt: Fake MP4 NetSupport delivery + ClingSTUN-related egress anomalies
// Microsoft Sentinel / Defender XDR
let suspicious_domains = dynamic(["x2664.com","usersecuritycheck.com","approvalrequest-api.com","karlenagida.com"]);
let suspicious_ips = dynamic(["89.34.90.111"]);
// 1. Network connections to known NetSupport delivery infrastructure
DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where RemoteUrl has_any (suspicious_domains)
   or RemoteIP in (suspicious_ips)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort
| extend HuntType = "Known IOC Match"
;
// 2. PowerShell fetching .mp4 files (behavioral)
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where FileName in~ ("powershell.exe","pwsh.exe")
| where ProcessCommandLine has_any (".mp4","DownloadFile","DownloadString","Invoke-WebRequest","Start-BitsTransfer")
   and ProcessCommandLine has_any ("http://","https://")
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName
| extend HuntType = "PowerShell MP4 Download Cradle"
;
// 3. NetSupport client execution from non-standard locations
DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where FileName =~ "client32.exe"
| where not (FolderPath has_any ("Program Files\\NetSupport","Program Files (x86)\\NetSupport"))
| project TimeGenerated, DeviceName, AccountName, FolderPath, ProcessCommandLine, SHA256
| extend HuntType = "NetSupport Client Non-Standard Path"
;
// 4. STUN (3478) egress from servers/edge-adjacent Linux hosts - ClingSTUN proxy behavior
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemotePort == 3478
| where RemoteIPType == "Public"
| where not (InitiatingProcessFileName has_any ("teams","zoom","skype","webrtc","chrome","firefox","msedge"))
| summarize ConnCount = count(), RemoteIPs = make_set(RemoteIP, 20) by DeviceName, InitiatingProcessFileName
| where ConnCount > 50
| extend HuntType = "Anomalous STUN Egress Volume"

# Security Arsenal - Fake MP4 / NetSupport & ClingSTUN Windows-Side IOC Hunt
# Run elevated. Outputs JSON results per host.

$results = [ordered]@{ Host = $env:COMPUTERNAME; Timestamp = (Get-Date).ToString('o'); Findings = @() }

# 1. DNS cache check for known NetSupport delivery domains
$badDomains = @('x2664.com','usersecuritycheck.com','approvalrequest-api.com','karlenagida.com')
$dnsCache = Get-DnsClientCache -ErrorAction SilentlyContinue
foreach ($d in $badDomains) {
    $hits = $dnsCache | Where-Object { $_.Entry -like "*$d*" }
    if ($hits) { $results.Findings += [ordered]@{ Type='DNSCache'; Indicator=$d; Detail=($hits | Out-String) } }
}

# 2. Active/historical TCP connections to known bad IP
$conns = Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object { $_.RemoteAddress -eq '89.34.90.111' }
if ($conns) { $results.Findings += [ordered]@{ Type='NetworkConnection'; Indicator='89.34.90.111'; Detail=($conns | Select-Object State,RemotePort,OwningProcess | Out-String) } }

# 3. NetSupport client artifacts: processes, services, Run keys
$nsProcs = Get-Process -ErrorAction SilentlyContinue | Where-Object { $_.ProcessName -match 'client32|pcictlui|nsm' }
foreach ($p in $nsProcs) {
    if ($p.Path -notmatch 'Program Files.*NetSupport') {
        $results.Findings += [ordered]@{ Type='Process'; Indicator='NetSupportClient'; Detail="$($p.ProcessName) -> $($p.Path)" }
    }
}
$runKeys = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run','HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run','HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run')
foreach ($rk in $runKeys) {
    Get-ItemProperty -Path $rk -ErrorAction SilentlyContinue | Get-Member -MemberType NoteProperty | ForEach-Object {
        $val = (Get-ItemProperty -Path $rk -Name $_.Name -ErrorAction SilentlyContinue).($_.Name)
        if ($val -match 'client32|netsupport|\.mp4') {
            $results.Findings += [ordered]@{ Type='RunKey'; Indicator=$rk; Detail="$($_.Name) = $val" }
        }
    }
}
Get-Service -ErrorAction SilentlyContinue | Where-Object { $_.Name -match 'client32|netsupport' } | ForEach-Object {
    $results.Findings += [ordered]@{ Type='Service'; Indicator=$_.Name; Detail="Status=$($_.Status)" }
}

# 4. Suspicious MP4 files with oversized uuid boxes (heuristic: MP4 >5MB recently written to user/temp paths)
$searchPaths = @("$env:TEMP","$env:USERPROFILE\Downloads","C:\ProgramData","C:\Users\Public")
foreach ($sp in $searchPaths) {
    Get-ChildItem -Path $sp -Filter '*.mp4' -Recurse -ErrorAction SilentlyContinue |
        Where-Object { $_.Length -gt 5MB -and $_.LastWriteTime -gt (Get-Date).AddDays(-14) } |
        ForEach-Object {
            # Check for uuid box signature within first 64KB
            $fs = [System.IO.File]::OpenRead($_.FullName)
            $buf = New-Object byte[] 65536; [void]$fs.Read($buf,0,65536); $fs.Close()
            $head = [System.Text.Encoding]::ASCII.GetString($buf)
            $uuidPresent = $head -match 'uuid'
            $noMoov = $head -notmatch 'moov'
            if ($uuidPresent -and $noMoov) {
                $results.Findings += [ordered]@{ Type='SuspiciousMP4'; Indicator=$_.FullName; Detail="Size=$($_.Length); uuid box present, no moov atom in header" }
            }
        }
}

# 5. PowerShell ScriptBlock/Process execution referencing mp4 (Event 4688/4104 style check via recent event log)
Get-WinEvent -FilterHashtable @{ LogName='Security'; Id=4688; StartTime=(Get-Date).AddDays(-7) } -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'powershell' -and $_.Message -match '\.mp4' } |
    Select-Object -First 20 | ForEach-Object {
        $results.Findings += [ordered]@{ Type='Event4688'; Indicator='PowerShell+MP4'; Detail=$_.Message.Substring(0,[Math]::Min(300,$_.Message.Length)) }
    }

$results | ConvertTo-Json -Depth 4