Cross-Platform Infostealer Surge: Laravel Supply Chain & FIFA Phishing Intelligence

title: Potential Laravel Lang Helpers.php Backdoor Activity
id: a1b2c3d4-2026-05-27-laravel-rce
description: Detects potential RCE activity stemming from the compromised laravel-lang packages where PHP processes spawn suspicious shells or network tools.
status: experimental
date: 2026/05/27
author: Security Arsenal
references:
    - https://socket.dev/blog/laravel-lang-compromise
tags:
    - attack.initial_access
    - attack.t1195.002
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith:
            - '\php.exe'
            - '\php-cgi.exe'
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
            - '\curl.exe'
            - '\wget.exe'
    condition: selection
falsepositives:
    - Legitimate administrative tasks by developers
level: high
---
title: TwizAdmin C2 Network Connection
id: e5f6g7h8-2026-05-27-twizadmin-c2
description: Detects network connections to known TwizAdmin C2 infrastructure or FastAPI panels associated with the DataBreachPlus actor.
status: experimental
date: 2026/05/27
author: Security Arsenal
references:
    - https://intel.breakglass.tech/post/twizadmin-103-241-66
tags:
    - attack.command_and_control
    - attack.t1071.001
logsource:
    category: network_connection
    product: windows
detection:
    selection_ip:
        DestinationIp:
            - '103.241.66.238'
    selection_domain:
        DestinationHostname|contains:
            - 'fanonlyatn.xyz'
    condition: 1 of selection*
falsepositives:
    - Unknown
level: critical
---
title: ClearFake EtherHiding Blockchain C2 Traffic
id: i9j0k1l2-2026-05-27-clearfake-bsc
description: Detects browser processes initiating connections to BNB Smart Chain (BSC) RPC endpoints, indicative of ClearFake utilizing smart contracts for C2.
status: experimental
date: 2026/05/27
author: Security Arsenal
references:
    - https://www.trendmicro.com/en_us/research/26/e/smart-contracts-for-command-and-control.html
tags:
    - attack.command_and_control
    - attack.t1102.002
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Image|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
        DestinationPort:
            - 8545
            - 443
        DestinationHostname|contains:
            - 'bsc-dataseed'
            - 'binance.org'
            - 'bnbchain.org'
    filter_legit:
        Initiated: 'false' # Filter for inbound connections if necessary, though browsers do outbound
    condition: selection
falsepositives:
    - Users accessing legitimate Web3 dApps or crypto wallets
level: medium


kql
// Hunt for Ghost Stadium and Laravel Compromise Network Indicators
let ioc_domains = dynamic(['fifa.gold', 'fifa.black', 'fifa.tax', 'fifaweb.com', 'fifa.red', 'fifa.fund', 'fifa-com.shop', 'flipboxstudio.info']);
let ioc_ips = dynamic(['148.178.22.16', '103.241.66.238']);
DeviceNetworkEvents
| where RemoteUrl in~ ioc_domains or RemoteIP in~ ioc_ips
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, RemotePort
| extend FullUrl = strcat(RemoteUrl, "/") 
| summarize count() by DeviceName, RemoteUrl, RemoteIP
| order by count_ desc


powershell
# IOC Hunt Script for Laravel Backdoor and TwizAdmin Artifacts
# Requires Admin Privileges

Write-Host "[+] Starting Hunt for Laravel Compromise and TwizAdmin Artifacts..." -ForegroundColor Cyan

# 1. Check for the malicious Laravel helpers.php in common vendor directories
$vendorPaths = @(
    "$env:USERPROFILE\Projects",
    "C:\xampp\htdocs",
    "C:\inetpub\wwwroot"
)

$maliciousHash = "06299676b43749b8477c4bc977c09512957fc9b66fd5030c1874069632ce6092" # Example hash from pulse

Write-Host "[+] Scanning for helpers.php backdoor..." -ForegroundColor Yellow
foreach ($path in $vendorPaths) {
    if (Test-Path $path) {
        Get-ChildItem -Path $path -Recurse -Filter "helpers.php" -ErrorAction SilentlyContinue | ForEach-Object {
            $fileHash = (Get-FileHash -Path $_.FullName -Algorithm SHA256).Hash
            if ($fileHash -eq $maliciousHash) {
                Write-Host "[!] MALICIOUS FILE FOUND: $($_.FullName)" -ForegroundColor Red
            } else {
                Write-Host "[+] Found helpers.php at: $($_.FullName) (Hash: $fileHash)" -ForegroundColor Green
            }
        }
    }
}

# 2. Check DNS Cache for Ghost Stadium and TwizAdmin Domains
$domains = @("fanonlyatn.xyz", "fifa.gold", "fifa.black", "flipboxstudio.info")
Write-Host "[+] Checking DNS Cache for malicious domains..." -ForegroundColor Yellow

$dnsEntries = Get-DnsClientCache | Where-Object { $domains -contains $_.Entry }
if ($dnsEntries) {
    foreach ($entry in $dnsEntries) {
        Write-Host "[!] Suspicious DNS Entry: $($entry.Entry) -> $($entry.Data)" -ForegroundColor Red
    }
} else {
    Write-Host "[-] No malicious DNS entries found in cache." -ForegroundColor Green
}

# 3. Check for connections to TwizAdmin C2 IP
$ip = "103.241.66.238"
$connections = Get-NetTCPConnection -RemoteAddress $ip -ErrorAction SilentlyContinue
if ($connections) {
    Write-Host "[!] ACTIVE CONNECTION TO TWIZADMIN C2 DETECTED!" -ForegroundColor Red
    $connections | Format-Table -AutoSize
} else {
    Write-Host "[-] No active connections to TwizAdmin C2 detected." -ForegroundColor Green
}