Evilginx AiTM, Midnight Blizzard CaptiveCrunch, APT37 RokRAT: OTX Detection Pack

Threat Summary

Three TLP:white OTX pulses converge on one enterprise risk: identity is the primary kill chain, and commodity crimeware is sharing tradecraft with nation-state operators. The first pulse exposes how a single misconfigured Python HTTP server on a Budapest VPS revealed three phishing operators, including codemado, running an Adversary-in-The-Middle platform around Evilginx, OAuth abuse, RMM tooling, AsyncRAT, and a custom MaDoO Blaster across finance, government, healthcare, retail, construction, and technology victims in at least a dozen countries. The second attributes hotel and conference Wi-Fi captive-portal manipulation to UNC2452 / Midnight Blizzard / APT29 tradecraft, using DNS and HTTP redirection to push Microsoft 365 phishing, device-code phishing against Microsoft Entra ID, ClickFix-style social engineering, CornFlake, and ChocoShell. The third details APT37's Operation Capsule Vault, a RokRAT spear-phishing chain that abuses academic-conference lures, cloud-storage links, ISO delivery, PIF masquerading as PDF, and an EMBED_PAYLOAD_v2 loader that pairs decoy documents with payload execution.

Collectively, the campaigns show initial access through trusted workflows: travel Wi-Fi, OAuth consent and device-code flows, cloud links, conference materials, and look-alike Microsoft 365 domains. Objectives are session-token theft, durable account access, remote-control tooling, and collection from research, policy, education, and government-adjacent users. Treat credential compromise as likely even where malware is not recovered, because AiTM and device-code abuse can bypass MFA prompts by replaying live sessions or minting tokens through legitimate flows.

Threat Actor / Malware Profile

codemado / MaDoO Blaster / AsyncRAT / Evilginx: Distribution is phishing-led, with infrastructure hosted on exposed VPS directories and hostnames under picis.net such as hrvetbr.picis.net, hervw.picis.net, cdn.picis.net, and hervw2.picis.net. Evilginx provides reverse-proxy AiTM capture of credentials and session cookies; AsyncRAT provides remote control, keylogging, credential theft, and secondary payload staging; RMM tooling is likely used for hands-on persistence and blending into admin behavior. C2 is web and DNS oriented, favoring look-alike CDN and host subdomains. Persistence commonly lands in Run keys, scheduled tasks, services, or RMM enrollment. Anti-analysis includes open-directory exposure by mistake rather than sophistication, payload packing, legitimate cloud/proxy abuse, and masquerading as benign Microsoft or conference resources.
UNC2452 / Midnight Blizzard / APT29, CornFlake, ChocoShell: Distribution uses compromised or manipulated captive portals at hotels and conference centers, DNS/HTTP redirection, M365 credential pages, device-code phishing, and ClickFix prompts that trick users into running commands. Payload behavior centers on credential harvesting, token capture, and staged PowerShell/shell execution. C2 uses attacker domains such as m365-owa.com, ms365-device.com, ms365-live.com, owa-ms365.com and IPv4 38.146.28.75; CVE-2026-21509 is listed as an associated exploit reference. Persistence is identity-first: refresh tokens, app consent, mailbox rules, and possibly endpoint tasks if ClickFix execution succeeds. Anti-analysis relies on living off legitimate Microsoft authentication, short-lived redirect chains, venue-specific targeting, and social engineering that defeats attachment-only sandboxing.
APT37 RokRAT, S0240: Distribution is spear-phishing with academic-conference lures and links to Yandex/pCloud-style storage delivering an ISO. Inside, a PIF executable masquerades as a PDF; EMBED_PAYLOAD_v2 embeds decoy documents beside the loader to reduce suspicion. Payload behavior includes collection from research, policy, and education targets, staged payload decoding, and cloud-service abuse for exfiltration or dead-drop C2. Persistence historically uses Run keys, scheduled tasks, or startup-folder artifacts. Anti-analysis includes ISO/PIF masquerading, decoy content, embedded payload structures, and use of legitimate cloud APIs.

The pulses leave MITRE fields unpopulated; detection below maps to inferred techniques: T1566 spear-phishing, T1204 user execution, T1036 masquerading, T1557 adversary-in-the-middle, T1550 use of stolen tokens, T1071.001 web C2, T1105 ingress tool transfer, and T1059 command or script execution.

IOC Analysis

The indicator set is dominated by infrastructure and hashes rather than URLs. Domains and hostnames are highest value for rapid containment: picis.net plus subdomains hrvetbr.picis.net, hervw.picis.net, cdn.picis.net, hervw2.picis.net; M365 look-alikes m365-owa.com, ms365-device.com, ms365-live.com, owa-ms365.com. IPv4 38.146.28.75 should be blocked at egress and hunted in DNS, proxy, firewall, and EDR network telemetry. File hashes are useful for retro-hunting and confirming payload staging: MD5 1a37b674ed29c877890834e9aba616d9, SHA1 ea5d2096a2ef3dfe4fb870bd1f0270efaea993a6, SHA256 7f30259d72eb7432b2454c07be83365ecfa835188185b35b30d11654aadf86a0; SHA256 918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593 and be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c; RokRAT MD5 e5c9bb3938f2a24e755ee39073fc3aca. CVE-2026-21509 should be treated as an exposure and patch-intel lead until vendor details are validated.

SOC operationalization: push domains/IP to DNS sinkhole, secure web gateway, EDR network block, and email URL rewriting; add hashes to EDR reputation and block lists; create alerting for OAuth grants, device-code sign-ins, impossible travel, and session reuse after MFA; pivot from indicators to behavior because AiTM operators rotate domains quickly. Tooling: OTX pulses for context, Microsoft Defender/EDR for hash and network telemetry, Sentinel for identity correlation, urlscan.io and VirusTotal for redirect-chain expansion, CyberChef for script/loader decoding, dnstwist for look-alike discovery, and Sigma/KQL below for behavior coverage.

Detection Engineering

YAML

---
title: AiTM Phishing or Evilginx Infrastructure Contact
id: 9f7d2f10-8a6d-4f3f-9d21-2c6f2b7a5111
status: experimental
description: Detects endpoint DNS or network contact to exposed AiTM phishing infrastructure and M365 look-alike domains reported in OTX pulses for codemado, Evilginx, AsyncRAT, and Midnight Blizzard captive portal operations.
author: Security Arsenal
date: 2026/08/12
references:
  - https://blog.lexfo.fr/opendir-to-phishing-operator.html
  - https://www.zscaler.com/blogs/security-research/captivecrunch-midnight-blizzard-weaponizes-hotel-wi-fi-captive-portals
logsource:
  category: dns
  product: windows
level: high
detection:
  selection_domain:
    QueryName|contains:
      - picis.net
      - m365-owa.com
      - ms365-device.com
      - ms365-live.com
      - owa-ms365.com
  selection_host:
    QueryName|contains:
      - hrvetbr.picis.net
      - hervw.picis.net
      - cdn.picis.net
      - hervw2.picis.net
  condition: selection_domain or selection_host
falsepositives:
  - Threat research, sandbox detonation, or explicit IOC validation.
fields:
  - QueryName
  - Computer
  - IpAddress
tags:
  - attack.t1557
  - attack.t1071.001
  - attack.t1566
---
title: Suspicious ISO Mount and PIF PDF Masquerade Execution
id: 8c8c1f7d-4d16-4cb0-9d45-53b22d751ec0
status: experimental
description: Detects RokRAT-style initial execution where an ISO is mounted and a PIF or executable masquerading as a document launches from user-controlled paths after cloud-download delivery.
author: Security Arsenal
date: 2026/08/12
references:
  - https://www.genians.co.kr/en/blog/threat_intelligence/rokrat_capsule_vault?hs_amp=true
logsource:
  category: process_creation
  product: windows
level: high
detection:
  selection_ext:
    Image|endswith:
      - .pif
      - .scr
      - .exe
  selection_name:
    Image|contains:
      - .pdf.
      - conference
      - abstract
      - agenda
      - paper
  selection_path:
    Image|contains:
      - Users
      - AppData
      - Temp
      - Downloads
  selection_parent:
    ParentImage|endswith:
      - explorer.exe
      - powershell.exe
      - cmd.exe
  condition: selection_ext and selection_path and (selection_name or selection_parent)
falsepositives:
  - Legitimate conference utilities or portable document tools, which should be rare and publisher-signed.
fields:
  - Image
  - CommandLine
  - ParentImage
  - User
  - Hashes
tags:
  - attack.t1036
  - attack.t1204
  - attack.t1566.001
---
title: ClickFix or Device Code Phishing Follow-On Command Execution
id: 6d33f0fb-9bb1-4a0b-9229-1a4a1a53ef22
status: experimental
description: Detects user-launched PowerShell, cmd, mshta, rundll32, or curl after browser or captive-portal interaction, consistent with ClickFix social engineering and OAuth device code phishing follow-on staging.
author: Security Arsenal
date: 2026/08/12
references:
  - https://www.zscaler.com/blogs/security-research/captivecrunch-midnight-blizzard-weaponizes-hotel-wi-fi-captive-portals
logsource:
  category: process_creation
  product: windows
level: medium
detection:
  selection_img:
    Image|endswith:
      - powershell.exe
      - pwsh.exe
      - cmd.exe
      - mshta.exe
      - rundll32.exe
      - curl.exe
      - bitsadmin.exe
  selection_parent:
    ParentImage|endswith:
      - chrome.exe
      - msedge.exe
      - firefox.exe
      - iexplore.exe
      - explorer.exe
  selection_cli:
    CommandLine|contains:
      - -enc
      - -e 
      - FromBase64String
      - IEX
      - Invoke-Expression
      - downloadstring
      - devicecode
      - oauth
      - ms365
      - http://
      - https://
  condition: selection_img and selection_parent and selection_cli
falsepositives:
  - Admin automation launched from documentation pages; tune by parent process, signer, and command entropy.
fields:
  - Image
  - CommandLine
  - ParentImage
  - User
  - ProcessId
tags:
  - attack.t1059.001
  - attack.t1204
  - attack.t1105
  - attack.t1550

KQL — Microsoft Sentinel / Defender

let lookalikes = dynamic(['picis.net','hrvetbr.picis.net','hervw.picis.net','cdn.picis.net','hervw2.picis.net','m365-owa.com','ms365-device.com','ms365-live.com','owa-ms365.com']);
let bad_ip = '38.146.28.75';
let hashes = dynamic(['1a37b674ed29c877890834e9aba616d9','ea5d2096a2ef3dfe4fb870bd1f0270efaea993a6','7f30259d72eb7432b2454c07be83365ecfa835188185b35b30d11654aadf86a0','918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593','be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c','e5c9bb3938f2a24e755ee39073fc3aca']);
let net =
DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where RemoteIP == bad_ip or RemoteUrl has_any (lookalikes)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, ActionType;
let dns =
DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where RemoteUrl has_any (lookalikes)
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Hits=count() by DeviceName, RemoteUrl, InitiatingProcessFileName;
let files =
DeviceFileEvents
| where TimeGenerated > ago(14d)
| where MD5 in (hashes) or SHA1 in (hashes) or SHA256 in (hashes) or FileName endswith '.pif' or FileName contains '.pdf.' or FolderPath has_any ('Downloads','Temp','AppData')
| project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName;
let proc =
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where FileName in~ ('powershell.exe','pwsh.exe','cmd.exe','mshta.exe','rundll32.exe','curl.exe','bitsadmin.exe')
| where InitiatingProcessFileName in~ ('chrome.exe','msedge.exe','firefox.exe','iexplore.exe','explorer.exe')
| where ProcessCommandLine has_any ('-enc','FromBase64String','Invoke-Expression','IEX','downloadstring','devicecode','oauth','ms365')
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName;
union net, dns, files, proc
| sort by TimeGenerated desc

PowerShell

$ErrorActionPreference = 'SilentlyContinue'
$domains = 'picis.net','hrvetbr.picis.net','hervw.picis.net','cdn.picis.net','hervw2.picis.net','m365-owa.com','ms365-device.com','ms365-live.com','owa-ms365.com'
$badIp = '38.146.28.75'
$hashes = '1a37b674ed29c877890834e9aba616d9','ea5d2096a2ef3dfe4fb870bd1f0270efaea993a6','7f30259d72eb7432b2454c07be83365ecfa835188185b35b30d11654aadf86a0','918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593','be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c','e5c9bb3938f2a24e755ee39073fc3aca'
$report = @()

Get-NetTCPConnection -State Established | Where-Object { $_.RemoteAddress -eq $badIp } | ForEach-Object {
  $p = Get-Process -Id $_.OwningProcess
  $report += [pscustomobject]@{Type='Network'; Time=(Get-Date); Host=$env:COMPUTERNAME; Path=$p.Path; Detail=($_.RemoteAddress + ':' + $_.RemotePort); Process=$p.ProcessName}
}

$paths = @($env:TEMP, $env:LOCALAPPDATA, $env:USERPROFILE + '\Downloads', $env:APPDATA)
foreach ($path in $paths) {
  Get-ChildItem $path -Recurse -Force -File -Include *.pif,*.exe,*.scr,*.iso,*.pdf.* | ForEach-Object {
    $h = (Get-FileHash $_.FullName -Algorithm SHA256).Hash
    $m = (Get-FileHash $_.FullName -Algorithm MD5).Hash
    if ($hashes -contains $h.ToLower() -or $hashes -contains $m.ToLower() -or $_.Name -match '\.pdf\.' -or $_.Extension -eq '.pif') {
      $report += [pscustomobject]@{Type='File'; Time=$_.LastWriteTime; Host=$env:COMPUTERNAME; Path=$_.FullName; Detail=('SHA256=' + $h); Process=''}
    }
  }
}

$run = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run','HKLM:\Software\Microsoft\Windows\CurrentVersion\Run'
foreach ($k in $run) {
  Get-ItemProperty $k | ForEach-Object {
    $_.PSObject.Properties | Where-Object { $_.Value -match 'Temp|AppData|Downloads|\.pif|\.scr|powershell|mshta|rundll32' } | ForEach-Object {
      $report += [pscustomobject]@{Type='Autorun'; Time=(Get-Date); Host=$env:COMPUTERNAME; Path=$k; Detail=($_.Name + '=' + $_.Value); Process=''}
    }
  }
}

Get-ScheduledTask | Where-Object { $_.Actions.Execute -match 'powershell|mshta|rundll32|cmd' -and ($_.Actions.Arguments -match 'Temp|AppData|Downloads|http|ms365|devicecode') } | ForEach-Object {
  $report += [pscustomobject]@{Type='Task'; Time=(Get-Date); Host=$env:COMPUTERNAME; Path=$_.TaskName; Detail=($_.Actions.Execute + ' ' + $_.Actions.Arguments); Process=''}
}

$dnsCache = Get-DnsClientCache | Where-Object { $name = $_.Name; $domains | Where-Object { $name -like ('*' + $_ + '*') } }
$dnsCache | ForEach-Object { $report += [pscustomobject]@{Type='DNSCache'; Time=(Get-Date); Host=$env:COMPUTERNAME; Path=''; Detail=($_.Name + ' -> ' + $_.Data); Process=''} }

$report | Sort-Object Type, Time -Descending | Format-Table -AutoSize
$report | Export-Csv -NoTypeInformation -Path ($env:USERPROFILE + '\Desktop\otx_aitm_rokrat_hunt.csv')

Response Priorities

Immediate: Block listed domains, hostnames, IP 38.146.28.75, and hashes at DNS, proxy, EDR, email, and firewall controls. Hunt for mounted ISOs, PIF or document-masquerade executables, browser-spawned scripting, RMM installs, AsyncRAT artifacts, DNS cache hits, and outbound sessions to look-alike M365 infrastructure. Preserve proxy, DNS, EDR, VPN, captive-portal, and identity logs before rotation.

24h: Because AiTM and device-code phishing can defeat MFA by stealing sessions or minting tokens, revoke refresh tokens and sessions for exposed users, reset credentials, re-enroll MFA, remove suspicious OAuth consents, audit mailbox rules and forwarding, review Entra sign-ins for device-code flow, impossible travel, and token replay, and require phishing-resistant MFA for high-risk users. Treat hotel or conference Wi-Fi users as elevated risk.

1 week: Harden architecture against the vector: enforce phishing-resistant FIDO2/passkeys for admins and targeted groups, conditional access with token protection and compliant-device requirements, egress DNS filtering with category and look-alike blocking, browser isolation for unknown sites, ISO/PIF/SCR attachment blocking, application control for user-writable paths, RMM allow-listing, captive-portal user guidance, cloud-storage link controls, and detections for OAuth consent, device-code sign-in, ClickFix process ancestry, and cloud API exfiltration.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub