Defending Against Pro-Russian Hacktivism: Detecting CARR and Z-Pentest Operations

---
title: Potential CARR DDoSia Agent Execution
id: 2026-carr-ddosia-exec-001
status: experimental
description: Detects the execution of the DDoSia tool, commonly associated with the CyberArmy of Russia Reborn (CARR). Matches process execution of python scripts or binaries with naming conventions observed in 2026 campaigns.
references:
  - https://bleepingcomputer.com/news/security/spain-arrests-suspected-member-of-pro-russian-hacktivist-groups/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.impact
  - attack.t1498
defense_evasion:
  - attack.t1027
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\ddosia.exe'
      - '\ddosia.bat'
  selection_cli:
    CommandLine|contains:
      - 'ddosia'
      - 'python.*ddosia'
  selection_network:
    CommandLine|contains:
      - 'requests.get'
      - 'urllib.request'
    CommandLine|contains|all:
      - '--target'
      - '--threads'
  condition: 1 of selection_*
falsepositives:
  - Legitimate network stress testing by authorized staff
level: high
---
title: Suspicious Web Shell Upload (Z-Pentest Style)
id: 2026-zpentest-webshell-002
status: experimental
description: Detects the creation of files indicative of web shell activity often associated with Z-Pentest defacement operations. Focuses on common ASP/PHP web shell names and rapid creation in web roots.
references:
  - https://bleepingcomputer.com/news/security/spain-arrests-suspected-member-of-pro-russian-hacktivist-groups/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_create
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\inetpub\wwwroot\'
      - '\www\html\'
    TargetFilename|endswith:
      - '.asp.aspx'
      - '.php'
    TargetFilename|contains:
      - 'shell'
      - 'cmd'
      - 'uploader'
      - 'wso'
  condition: selection
falsepositives:
  - Legitimate CMS administration scripts
level: critical

// Hunt for DDoSia Agent Behavior: High volume outbound HTTP from a single process
DeviceNetworkEvents
| where ActionType == "ConnectionSuccess"
| where RemotePort in (80, 443, 8080)
| summarize TotalConnections = count(), DistinctRemoteIPs = dcount(RemoteIP), ProcessList = make_set(InitiatingProcessFileName) by DeviceName, InitiatingProcessAccountName, bin(Timestamp, 1m)
| where TotalConnections > 1000 // Threshold tuning required based on baseline
| project DeviceName, InitiatingProcessAccountName, TotalConnections, ProcessList, Timestamp
| order by TotalConnections desc
| extend AlertMessage = "High volume outbound HTTP traffic detected, potential DDoS agent activity."

-- Hunt for DDoSia artifacts and configuration files
SELECT FullPath, Size, Mtime, Mode
FROM glob(globs='/*')
WHERE FullPath =~ 'ddosia'
   OR FullPath =~ 'config.'
   AND FullPath =~ '(AppData|Temp|Downloads)'

-- Hunt for suspicious Python processes making network calls
SELECT Pid, Name, Exe, CommandLine, Username
FROM pslist()
WHERE Name =~ 'python.exe'
  AND CommandLine =~ '(requests|socket|urllib)'
  AND CommandLine =~ '(http|https)'

# Remediation Script: Detect and Terminate Hacktivist DDoS Agents
Write-Host "Starting scan for CARR/Z-Pentest associated processes..." -ForegroundColor Cyan

# Define suspicious process names often used by DDoSia and similar tools
$suspiciousProcesses = @("ddosia", "stress", "goldeneye", "hping3")

$foundProcesses = Get-Process | Where-Object { 
    $suspiciousProcesses -like $_.ProcessName 
} | Select-Object -Unique ProcessName, Id

if ($foundProcesses) {
    foreach ($proc in $foundProcesses) {
        Write-Host "[!] Suspicious process found: $($proc.ProcessName) (PID: $($proc.Id))" -ForegroundColor Red
        try {
            Stop-Process -Id $proc.Id -Force -ErrorAction Stop
            Write-Host "[+] Process terminated successfully." -ForegroundColor Green
        } catch {
            Write-Host "[-] Failed to terminate process: $_" -ForegroundColor Yellow
        }
    }
} else {
    Write-Host "[+] No suspicious processes currently running." -ForegroundColor Green
}

# Check for common DDoSia directories
$pathsToCheck = @("$env:APPDATA\ddosia", "$env:TEMP\ddosia", "C:\ddosia")
foreach ($path in $pathsToCheck) {
    if (Test-Path $path) {
        Write-Host "[!] Artifact directory found at: $path" -ForegroundColor Red
        # Note: Deletion should be verified by IR analyst before running in prod
    }
}
Write-Host "Remediation scan complete."