DinDoor Backdoor, AdaptixC2 Beacon, and The Gentlemen RaaS: OTX Threat Landscape Analysis — Detection & Response

title: Potential DinDoor Backdoor Activity via Deno Runtime
id: 8b4c2d1f-3a6e-4f5c-9b1a-8c7d6e5f4a3b
description: Detects suspicious execution of Deno runtime spawned by installers or with JS arguments, typical of DinDoor backdoor behavior.
status: experimental
date: 2026/05/24
author: Security Arsenal
references:
    - https://hunt.io/blog/dindoor-deno-runtime-backdoor-msi-analysis
tags:
    - attack.execution
    - attack.t1059.006
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith:
            - '\msiexec.exe'
            - '\cmd.exe'
        Image|endswith:
            - '\deno.exe'
        CommandLine|contains:
            - 'run'
            - 'bundle'
    condition: selection
falsepositives:
    - Legitimate developer usage of Deno
level: high
---
title: Trojanized SumatraPDF Spawning Suspicious Processes
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
description: Detects SumatraPDF spawning child processes like PowerShell or CMD, indicative of the Tropic Trooper AdaptixC2 campaign.
status: experimental
date: 2026/05/24
author: Security Arsenal
references:
    - AlienVault OTX
tags:
    - attack.initial_access
    - attack.t1204
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith:
            - '\SumatraPDF.exe'
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
            - '\regsvr32.exe'
    condition: selection
falsepositives:
    - Unknown (SumatraPDF should not spawn shells)
level: critical
---
title: Security Event Log Clearing (The Gentlemen Ransomware)
id: f1e2d3c4-b5a6-9876-fedc-ba9876543210
description: Detects attempts to clear Windows Event Logs, a defense evasion tactic heavily used by The Gentlemen ransomware.
status: experimental
date: 2026/05/24
author: Security Arsenal
references:
    - https://www.huntress.com/blog/the-gentlemen-ransomware-defense-evasion-ttps
tags:
    - attack.defense_evasion
    - attack.t1070.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_wevtutil:
        Image|endswith:
            - '\wevtutil.exe'
        CommandLine|contains:
            - 'cl'
            - 'clear-log'
    selection_powershell:
        Image|endswith:
            - '\powershell.exe'
        CommandLine|contains:
            - 'Remove-EventLog'
            - 'Clear-EventLog'
    condition: 1 of selection*
falsepositives:
    - Administrative log management scripts
level: high

// Hunt for DinDoor C2 Domains and File Hashes
let DinDoorHashes = dynamic(["2a09bbb3d1ddb729ea7591f197b5955453aa3769c6fb98a5ef60c6e4b7df23a5", "5c057af2f358fc10107d5ccdb39938ad"]);
let DinDoorDomains = dynamic(["ineracaspsl.site", "serialmenot.com", "justtalken.com", "hngfbgfbfb.cyou"]);
DeviceNetworkEvents
| where RemoteUrl in (DinDoorDomains) or InitiatingProcessSHA256 in (DinDoorHashes)
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP
| union (
    DeviceProcessEvents
    | where SHA256 in (DinDoorHashes) or ProcessCommandLine contains "deno"
    | project Timestamp, DeviceName, FileName, ProcessCommandLine
)
| extend Threat = "DinDoor / MuddyWater"

<#
.SYNOPSIS
    Hunt script for DinDoor, AdaptixC2, and Gentlemen Ransomware artifacts.
.DESCRIPTION
    Checks for suspicious Deno executions, SumatraPDF parent processes, and Event Log clearing evidence.
#>

Write-Host "[+] Hunting for DinDoor (Deno) Artifacts..." -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'deno.exe' } | 
    Select-Object TimeCreated, Message | Format-List

Write-Host "[+] Hunting for AdaptixC2 (Trojanized SumatraPDF)..." -ForegroundColor Cyan
$proccesses = Get-WmiObject Win32_Process | Where-Object { $_.Name -eq 'SumatraPDF.exe' }
foreach ($proc in $proccesses) {
    $children = Get-WmiObject Win32_Process | Where-Object { $_.ParentProcessId -eq $proc.ProcessId }
    if ($children) {
        Write-Host "ALERT: SumatraPDF (PID: $($proc.ProcessId)) spawned child process:" -ForegroundColor Red
        $children | Select-Object Name, CommandLine | Format-List
    }
}

Write-Host "[+] Checking for The Gentlemen Ransomware Persistence (Scheduled Tasks)..." -ForegroundColor Cyan
Get-ScheduledTask | Where-Object { 
    $_.Actions.Execute -match 'powershell' -or 
    $_.Actions.Execute -match 'cmd' -and 
    $_.TaskName -notmatch 'Microsoft' 
} | Select-Object TaskName, LastRunTime, Actions

Write-Host "[+] Checking for Event Log Clearing (Security ID 1102)..." -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=1102} -MaxEvents 5 -ErrorAction SilentlyContinue | 
    Select-Object TimeCreated, Message