CyberStrikeAI LLM-Orchestrated C2 + VOLTA AI-Powered Infostealer: OTX Pulse Analysis — Credential Theft & LLMjacking Detection Pack

---
title: CyberStrikeAI / NodeRabbit C2 Communication to Known Infrastructure
id: 8f3a2c11-9e4b-4d7a-a1c2-cyberstrikeai001
status: experimental
description: Detects network connections to CyberStrikeAI LLM-orchestrated C2 infrastructure identified in OTX pulses targeting education sector in Africa and Latin America
author: Security Arsenal Threat Intelligence
date: 2026/11/03
references:
    - https://securelist.com/tr/cyberstrikeai-attacks/121715/
logsource:
    category: network_connection
product: windows
detection:
    selection_ip:
        DestinationIp:
            - '104.234.26.163'
    selection_domain:
        DestinationHostname|contains:
            - 'fastcdn.bar'
    condition: selection_ip or selection_domain
falsepositives:
    - Unlikely; fastcdn.bar is not associated with legitimate CDN providers
level: high
tags:
    - attack.command_and_control
    - attack.t1071
---
title: VOLTA Infostealer LLM-Based Victim Profiling Egress
id: 7b2e9d44-3f1a-4c8e-b2d3-voltaai0002
status: experimental
description: Detects outbound connections to OpenRouter or LLM API endpoints from non-developer workstation processes, consistent with VOLTA infostealer submitting victim evidence bundles for AI-based monetization scoring
author: Security Arsenal Threat Intelligence
date: 2026/11/03
references:
    - https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer/
logsource:
    category: network_connection
product: windows
detection:
    selection_llm_egress:
        DestinationHostname|contains:
            - 'openrouter.ai'
            - 'api.anthropic.com'
            - 'api.openai.com'
    filter_legitimate_dev_tools:
        Image|endswith:
            - '\code.exe'
            - '\cursor.exe'
            - '\python.exe'
            - '\node.exe'
    filter_known_users:
        User|contains: 'dev_'
    condition: selection_llm_egress and not 1 of filter_*
falsepositives:
    - Developers testing LLM integrations from workstations; tune filters per environment
    - Legitimate AI-enabled applications; maintain an allowlist of approved AI tooling
level: medium
tags:
    - attack.exfiltration
    - attack.t1041
    - attack.credential_access
    - attack.t1555
---
title: Quick Assist Execution Followed by AD Credential Theft Tooling
id: 4c1f8a77-2d9b-4e3a-c5f6-teamsad00003
status: experimental
description: Detects Quick Assist remote support execution followed by Rclone, portable runtime, or DCSync-related activity consistent with Microsoft Teams help desk impersonation intrusions
author: Security Arsenal Threat Intelligence
date: 2026/11/03
references:
    - https://cyberpress.org/hackers-impersonate-it-help-desk-microsoft-teams/
logsource:
    category: process_creation
product: windows
detection:
    selection_quickassist:
        Image|endswith: '\quickassist.exe'
    selection_followup_tools:
        Image|endswith:
            - '\rclone.exe'
            - '\bun.exe'
        CommandLine|contains:
            - 'lsadump::dcsync'
            - 'PetitPotam'
            - 'syncall'
    timeframe: 30m
    condition: selection_quickassist | near selection_followup_tools
falsepositives:
    - Legitimate help desk use of Quick Assist; correlate with Teams chat origin and verify with IT ticketing system
    - Approved Rclone backup jobs; allowlist known service accounts and paths
level: critical
tags:
    - attack.remote_access
    - attack.t1219
    - attack.credential_access
    - attack.t1003.006
    - attack.exfiltration
    - attack.t1567.002

// Security Arsenal Hunt: AI-Orchestrated C2, VOLTA Egress & LLMjacking Infrastructure
// Scope: 30 days | Tables: DeviceNetworkEvents, DeviceProcessEvents
let Lookback = 30d;
let MaliciousIPs = dynamic(["104.234.26.163", "31.57.201.201", "38.246.114.118"]);
let MaliciousDomains = dynamic(["fastcdn.bar", "authgpt.info", "ai-billing.info", "url-y.uk", "artex.nhhh.de", "direct.465415.xyz"]);
let SuspiciousHostPatterns = dynamic([".nxcli.io", "465415.xyz"]);
// Stage 1: Network hits to known campaign infrastructure
let NetworkHits = DeviceNetworkEvents
    | where Timestamp > ago(Lookback)
    | where RemoteIP in (MaliciousIPs)
        or RemoteUrl has_any (MaliciousDomains)
        or RemoteUrl has_any (SuspiciousHostPatterns)
    | project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, ActionType;
// Stage 2: Suspicious LLM API egress from unexpected processes (VOLTA victim-profiling behavior)
let LLMEgress = DeviceNetworkEvents
    | where Timestamp > ago(Lookback)
    | where RemoteUrl has_any ("openrouter.ai", "api.anthropic.com", "api.openai.com")
    | where InitiatingProcessFileName !in~ ("code.exe", "cursor.exe", "python.exe", "node.exe", "msedge.exe", "chrome.exe", "firefox.exe")
    | project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl;
// Stage 3: Quick Assist followed by credential theft / exfil tooling (Teams impersonation chain)
let QuickAssistChain = DeviceProcessEvents
    | where Timestamp > ago(Lookback)
    | where FileName =~ "quickassist.exe"
    | join kind=inner (
        DeviceProcessEvents
        | where Timestamp > ago(Lookback)
        | where FileName has_any ("rclone.exe", "bun.exe")
            or ProcessCommandLine has_any ("dcsync", "PetitPotam", "lsadump")
    ) on DeviceName
    | where Timestamp1 between (Timestamp .. Timestamp + 30m)
    | project QuickAssistTime=Timestamp, ToolExecutionTime=Timestamp1, DeviceName, QuickAssistCmd=ProcessCommandLine, ToolCmd=ProcessCommandLine1;
union NetworkHits, LLMEgress, QuickAssistChain
| sort by Timestamp desc

# Security Arsenal IOC Hunt: CyberStrikeAI / VOLTA / LLMjacking / Teams-Impersonation Artifacts
# Run elevated. Checks network connections, DNS cache, suspicious runtimes, and persistence artifacts.

$ErrorActionPreference = 'SilentlyContinue'
$report = @()

# --- 1. Active & historical network connections to known C2 / phishing infra ---
$badIPs   = @('104.234.26.163','31.57.201.201','38.246.114.118')
$badNames = @('fastcdn.bar','authgpt.info','ai-billing.info','url-y.uk','artex.nhhh.de','direct.465415.xyz','nxcli.io')

Write-Host '[*] Checking active TCP connections...' -ForegroundColor Cyan
Get-NetTCPConnection | Where-Object { $badIPs -contains $_.RemoteAddress } | ForEach-Object {
    $report += [pscustomobject]@{ Check='ActiveC2Connection'; Detail="$($_.LocalAddress):$($_.LocalPort) -> $($_.RemoteAddress):$($_.RemotePort) [$($_.State)] PID=$($_.OwningProcess)" }
}

Write-Host '[*] Checking DNS client cache for malicious domain resolutions...' -ForegroundColor Cyan
Get-DnsClientCache | Where-Object { $n = $_.Name; $badNames | Where-Object { $n -like "*$_*" } } | ForEach-Object {
    $report += [pscustomobject]@{ Check='DNSCacheHit'; Detail="$($_.Name) -> $($_.Data)" }
}

# --- 2. VOLTA stealer artifacts: unexpected LLM API usage + known hash presence ---
Write-Host '[*] Scanning for VOLTA infostealer sample by hash...' -ForegroundColor Cyan
$voltaHash = '57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279'
$scanPaths = @("$env:TEMP","$env:APPDATA","$env:LOCALAPPDATA","$env:USERPROFILE\Downloads")
foreach ($p in $scanPaths) {
    Get-ChildItem -Path $p -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
        if ((Get-FileHash $_.FullName -Algorithm SHA256).Hash -eq $voltaHash) {
            $report += [pscustomobject]@{ Check='VOLTAHashMatch'; Detail=$_.FullName }
        }
    }
}

# --- 3. Teams-impersonation artifacts: Quick Assist logs, portable runtimes, Rclone ---
Write-Host '[*] Checking Quick Assist execution artifacts...' -ForegroundColor Cyan
$qaLogs = "$env:LOCALAPPDATA\Microsoft\QuickAssist"
if (Test-Path $qaLogs) {
    $report += [pscustomobject]@{ Check='QuickAssistArtifacts'; Detail="Quick Assist profile present: $qaLogs — review for unauthorized sessions" }
}

Write-Host '[*] Hunting for portable runtimes (python/bun/java) in user-writable paths...' -ForegroundColor Cyan
Get-ChildItem -Path "$env:APPDATA","$env:LOCALAPPDATA","$env:TEMP" -Recurse -Include 'bun.exe','rclone.exe' -ErrorAction SilentlyContinue | ForEach-Object {
    $report += [pscustomobject]@{ Check='SuspiciousPortableTool'; Detail=$_.FullName }
}

# --- 4. Persistence check: run keys & scheduled tasks referencing temp/appdata binaries ---
Write-Host '[*] Auditing Run keys and scheduled tasks for stealer persistence...' -ForegroundColor Cyan
$runKeys = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run','HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run')
foreach ($k in $runKeys) {
    (Get-ItemProperty $k).PSObject.Properties | Where-Object { $_.Value -match 'AppData|Temp|Public' } | ForEach-Object {
        $report += [pscustomobject]@{ Check='SuspiciousRunKey'; Detail="$k :: $($_.Name) = $($_.Value)" }
    }
}
Get-ScheduledTask | Where-Object { $_.Actions.Execute -match 'AppData|Temp' -and $_.TaskPath -notlike '\Microsoft*' } | ForEach-Object {
    $report += [pscustomobject]@{ Check='SuspiciousScheduledTask'; Detail="$($_.TaskName) -> $($_.Actions.Execute)" }
}

# --- 5. AI credential exposure: scan env vars of running processes for LLM API keys (LLMjacking risk) ---
Write-Host '[*] Checking for AI API keys exposed in common config locations...' -ForegroundColor Cyan
Get-ChildItem "$env:USERPROFILE\.env","$env:USERPROFILE\.config" -Recurse -ErrorAction SilentlyContinue |
    Select-String -Pattern 'OPENAI_API_KEY|ANTHROPIC_API_KEY|OPENROUTER' -List | ForEach-Object {
        $report += [pscustomobject]@{ Check='ExposedAICredential'; Detail="$($_.Path) — rotate key immediately if unauthorized egress is observed" }
    }

if ($report.Count -eq 0) { Write-Host '[+] No IOC artifacts found on this host.' -ForegroundColor Green }
else { $report | Format-Table -AutoSize; $report | Export-Csv -Path ".\ioc_hunt_$(Get-Date -Format yyyyMMdd_HHmm).csv" -NoTypeInformation; Write-Host "[!] $($report.Count) findings exported." -ForegroundColor Yellow }