FaceStealer & XLoader Infostealer Campaigns: Lazarus Group Social Engineering + ESXi Ransomware — OTX Pulse Detection Engineering Pack

---
title: Lazarus Group FaceStealer Fake Zoom C2 Communication
id: 5f8a3b2c-9d4e-4f1a-a8c7-3e2d1c0b9a8f
status: experimental
description: Detects network connections to fake Zoom infrastructure used by Lazarus Group FaceStealer campaigns
author: Security Arsenal Threat Intelligence
date: 2026/11/13
references:
    - https://www.helpnetsecurity.com/2026/11/13/fbi-north-korean-fake-zoom-calls/
logsource:
    category: network_connection
    product: windows
detection:
    selection_domain:
        DestinationHostname:
            - 'uu01webzoom.us'
            - '*.webzoom.us'
    selection_ip:
        DestinationIp: 188.240.57.94
    condition: selection_domain or selection_ip
falsepositives:
    - Legitimate Zoom usage (verify URL carefully)
level: high
tags:
    - attack.command_and_control
    - attack.t1071
    - attack.t1566
---
title: XLoader Infostealer Execution via CVE-2017-11882
id: 7a9c4d1e-3f2b-4a5c-9e8d-2c1b0a9f8e7d
status: experimental
description: Detects XLoader infection chain starting from malicious DOCX with altChunk exploitation leading to PowerShell execution
author: Security Arsenal Threat Intelligence
date: 2026/11/13
references:
    - https://asec.ahnlab.com/ko/96512/
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\winword.exe'
    selection_child:
        Image|endswith:
            - '\powershell.exe'
            - '\wscript.exe'
            - '\cscript.exe'
    selection_cmdline:
        CommandLine|contains:
            - 'ilto'
            - 'dumbsplash.com'
            - '.rtf'
    condition: selection_parent and selection_child and selection_cmdline
falsepositives:
    - Legitimate Office macros (rare in enterprise environments)
level: critical
tags:
    - attack.execution
    - attack.t1059.001
    - attack.t1203
    - attack.t1059.005
---
title: ESXi Ransomware Hypervisor Destruction Activity
id: 2c4e6f8a-1b3d-5e7f-9a0c-4d6e8f0a2c4e
status: experimental
description: Detects suspicious process execution and file encryption patterns associated with ESXi ransomware targeting virtualization infrastructure
author: Security Arsenal Threat Intelligence
date: 2026/11/13
references:
    - https://securelist.com/esxi-ransomware/121959/
logsource:
    category: process_creation
    product: linux
detection:
    selection_esxi:
        Image|endswith:
            - '/bin/sh'
            - '/bin/bash'
            - '/usr/bin/python*'
        CommandLine|contains:
            - 'vmware-esx'
            - 'esxcli'
            - 'vim-cmd'
    selection_crypto:
        CommandLine|contains:
            - 'encrypt'
            - 'aes'
            - 'rsa'
            - 'openssl'
    selection_suspicious:
        CommandLine|contains:
            - 'find /'
            - 'vmfs'
            - 'vmdk'
            - 'vmware.log'
    condition: selection_esxi and (selection_crypto or selection_suspicious)
falsepositives:
    - Legitimate ESXi administration (whitelist known admin IPs)
level: critical
tags:
    - attack.impact
    - attack.t1486
    - attack.t1490
    - attack.t1561

// Hunt 1: XLoader C2 Communication and Hash Detection
// Targets DeviceNetworkEvents for XLoader infrastructure and DeviceFileEvents for payload hashes
let xloader_hashes = dynamic([
    "5bd3c5f273ba5ae4c4ae745c6943a4f7",
    "8b3542531d98a47524c0f468d0158996",
    "e0d7a34bc9f4590bc073d08b50c854d1"
]);
union isfuzzy=true
    (DeviceNetworkEvents
    | where TimeGenerated > ago(7d)
    | where RemoteUrl contains "dumbsplash.com" or RemoteUrl contains "ilto"
    | project TimeGenerated, DeviceName, RemoteUrl, RemoteIP, InitiatingProcessFileName, InitiatingProcessCommandLine),
    (DeviceFileEvents
    | where TimeGenerated > ago(7d)
    | where MD5 in~ (xloader_hashes) or SHA256 in~ (xloader_hashes)
    | project TimeGenerated, DeviceName, FileName, FolderPath, MD5, SHA256, InitiatingProcessFileName)
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), count() by DeviceName, InitiatingProcessFileName, RemoteUrl
| order by FirstSeen desc;

// Hunt 2: FaceStealer Social Engineering Indicators
// Targets Office activity and network connections to fake Zoom infrastructure
let suspicious_zoom_domains = dynamic(["uu01webzoom.us", "webzoom.us"]);
DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where RemoteUrl has_any (suspicious_zoom_domains)
| join kind=inner (
    DeviceProcessEvents
    | where TimeGenerated > ago(14d)
    | where FileName =~ "Zoom.exe" or FileName =~ "Teams.exe"
) on DeviceId
| project TimeGenerated, DeviceName, RemoteUrl, RemoteIP, InitiatingProcessFileName, InitiatingProcessCommandLine, ProcessCommandLine
| extend SuspiciousIndicator = iff(RemoteUrl contains "uu01", "FaceStealer C2", "Unknown")
| order by TimeGenerated desc;

// Hunt 3: ESXi Management Interface Anomalies
// Detects unusual vCenter/ESXi management activity from non-admin workstations
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemotePort == 443 or RemotePort == 902 or RemotePort == 5480
| where RemoteIP startswith "10." or RemoteIP startswith "192.168." // Internal management IPs
| where InitiatingProcessFileName !in~ ("chrome.exe", "firefox.exe", "vmware.exe", "vpxd.exe")
| summarize ConnectionCount=count(), UniqueProcesses=dcount(InitiatingProcessFileName) by DeviceName, RemoteIP, InitiatingProcessFileName
| where ConnectionCount > 50 or UniqueProcesses > 3
| order by ConnectionCount desc;

<#
.SYNOPSIS
    Security Arsenal OTX Threat Hunt - FaceStealer/XLoader/ESXi Detection
.DESCRIPTION
    Hunts for indicators of compromise from 2026-11-13 OTX pulses including
    Lazarus FaceStealer C2, XLoader artifacts, and ESXi ransomware precursors.
.NOTES
    Author: Security Arsenal SOC
    Requires: Administrator privileges, PowerShell 5.1+
#>

$ErrorActionPreference = "SilentlyContinue"
$ReportPath = "C:\SecurityArsenal_ThreatHunt_$(Get-Date -Format 'yyyyMMdd_HHmmss').txt"

function Write-Log {
    param([string]$Message, [string]$Level = "INFO")
    $LogEntry = "[$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')] [$Level] $Message"
    Add-Content -Path $ReportPath -Value $LogEntry
    Write-Host $LogEntry
}

Write-Log "=== Security Arsenal OTX Threat Hunt Started ===" "INFO"
Write-Log "Target Indicators: FaceStealer, XLoader, ESXi Ransomware" "INFO"

# IOC Definitions from OTX Pulses
$IOCs = @{
    Domains = @("uu01webzoom.us", "www.dumbsplash.com", "dumbsplash.com")
    IPs = @("188.240.57.94", "91.92.242.121", "188.208.141.210")
    MD5Hashes = @(
        "5bd3c5f273ba5ae4c4ae745c6943a4f7",
        "8b3542531d98a47524c0f468d0158996",
        "e0d7a34bc9f4590bc073d08b50c854d1",
        "3ccd2c02cf0661613816ca30032b4cdd"
    )
    SHA256Hashes = @(
        "0097a0406be20544e98e981075427f40789db40fe4a53b1b4523383a945328b7",
        "2e45277acfde3fb704179476b08f428f66a03670bbdbf2e8ec79c0b0333c009b",
        "425cd7072b5e9386ac94e97fe272980b6ef36240df6b5d77b371ab7378004c83",
        "b2270c29b3d0a49a716730d6ef108cffec0b1a4b159dd02e93333fb85e492b99",
        "d51f2bd7ffb49c224d8eaec2c8ca1c8ab9fce2fd5fdceea01eb54296c2f47b4d",
        "f796eb9ecf516e4f1fafcf89200d9f7d8ddd234f705e63f1bc8fc3ef583f0248"
    )
    SuspiciousPaths = @(
        "$env:TEMP\*.rtf",
        "$env:APPDATA\Microsoft\Word\*.rtf",
        "$env:USERPROFILE\Downloads\*purchase*order*.docx"
    )
}

# Check 1: Network Connections to Known Bad IPs/Domains
Write-Log "[CHECK 1] Scanning for network connections to known malicious infrastructure..." "INFO"

$NetworkConnections = Get-NetTCPConnection | Where-Object {
    $_.RemoteAddress -in $IOCs.IPs -or 
    ($_.RemoteAddress -ne "0.0.0.0" -and $_.RemoteAddress -ne "127.0.0.1" -and 
     (Resolve-DnsName -Name $_.RemoteAddress -ErrorAction SilentlyContinue).NameHost -match ($IOCs.Domains -join "|"))
}

if ($NetworkConnections) {
    Write-Log "ALERT: Suspicious network connections detected!" "CRITICAL"
    $NetworkConnections | ForEach-Object {
        Write-Log "  -> $($_.LocalAddress):$($_.LocalPort) -> $($_.RemoteAddress):$($_.RemotePort) [$($_.State)]" "CRITICAL"
    }
} else {
    Write-Log "  No suspicious network connections found." "SUCCESS"
}

# Check 2: DNS Cache for Malicious Domains
Write-Log "[CHECK 2] Checking DNS cache for FaceStealer/XLoader domains..." "INFO"
$DNSCache = Get-DnsClientCache | Where-Object { $_.Entry -match ($IOCs.Domains -join "|") }
if ($DNSCache) {
    Write-Log "ALERT: Malicious domains found in DNS cache!" "CRITICAL"
    $DNSCache | ForEach-Object { Write-Log "  -> $($_.Entry) [$($_.Data)]" "CRITICAL" }
} else {
    Write-Log "  DNS cache clean." "SUCCESS"
}

# Check 3: File System Artifacts (XLoader RTF/DOCX, Suspicious Executables)
Write-Log "[CHECK 3] Scanning for XLoader document artifacts and suspicious files..." "INFO"

$SuspiciousFiles = Get-ChildItem -Path $env:TEMP, $env:APPDATA, $env:USERPROFILE
downloads -Recurse -ErrorAction SilentlyContinue | 
    Where-Object { $_.Extension -in @(".rtf", ".docx", ".vbs", ".ps1") } | 
    Select-Object -First 100

foreach ($File in $SuspiciousFiles) {
    $MD5 = (Get-FileHash -Path $File.FullName -Algorithm MD5).Hash
    $SHA256 = (Get-FileHash -Path $File.FullName -Algorithm SHA256).Hash
    
    if ($MD5 -in $IOCs.MD5Hashes -or $SHA256 -in $IOCs.SHA256Hashes) {
        Write-Log "ALERT: Malicious file detected: $($File.FullName)" "CRITICAL"
        Write-Log "  MD5: $MD5" "CRITICAL"
        Write-Log "  SHA256: $SHA256" "CRITICAL"
    }
    
    # Check for XLoader altChunk exploitation patterns
    if ($File.Extension -eq ".docx") {
        $Content = Get-Content -Path $File.FullName -Raw -ErrorAction SilentlyContinue
        if ($Content -match "altChunk" -and $Content -match "rtf") {
            Write-Log "WARNING: Potential XLoader altChunk exploitation in: $($File.FullName)" "WARNING"
        }
    }
}

# Check 4: Process and Service Anomalies (ESXi Ransomware precursors)
Write-Log "[CHECK 4] Checking for suspicious processes and services..." "INFO"

$SuspiciousProcesses = Get-Process | Where-Object {
    $_.ProcessName -match "(powershell|wscript|cscript|cmd)" -and 
    $_.CommandLine -match "(dumbsplash|ilto|encrypt|vmdk|vmfs)"
}

if ($SuspiciousProcesses) {
    Write-Log "ALERT: Suspicious processes detected!" "CRITICAL"
    $SuspiciousProcesses | ForEach-Object {
        Write-Log "  -> $($_.ProcessName) (PID: $($_.Id)): $($_.CommandLine)" "CRITICAL"
    }
}

# Check 5: Registry Persistence Mechanisms (XLoader Run Keys)
Write-Log "[CHECK 5] Scanning registry for persistence mechanisms..." "INFO"

$RunKeys = @(
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce",
    "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
    "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce"
)

foreach ($Key in $RunKeys) {
    $Values = Get-ItemProperty -Path $Key -ErrorAction SilentlyContinue
    if ($Values) {
        $Values.PSObject.Properties | ForEach-Object {
            if ($_.Value -match "(powershell|wscript).*(http|temp|appdata)") {
                Write-Log "WARNING: Suspicious registry persistence: $Key\$($_.Name) = $($_.Value)" "WARNING"
            }
        }
    }
}

# Check 6: ESXi Management Interface Exposure (if applicable)
Write-Log "[CHECK 6] Checking for VMware ESXi/vCenter management interfaces..." "INFO"
$VMwarePorts = @(443, 902, 5480, 8080, 9080)
foreach ($Port in $VMwarePorts) {
    $Connections = Get-NetTCPConnection -LocalPort $Port -ErrorAction SilentlyContinue | 
        Where-Object { $_.State -eq "Listen" }
    if ($Connections) {
        Write-Log "INFO: VMware management port $Port is listening. Verify this is authorized." "WARNING"
    }
}

# Check 7: Scheduled Tasks for Persistence
Write-Log "[CHECK 7] Checking scheduled tasks for malicious entries..." "INFO"
$Tasks = Get-ScheduledTask | Where-Object { $_.TaskName -notmatch "Microsoft|Windows" }
foreach ($Task in $Tasks) {
    $Actions = $Task.Actions | Where-Object { $_.Execute -match "powershell|wscript" }
    if ($Actions) {
        Write-Log "WARNING: Suspicious scheduled task: $($Task.TaskName)" "WARNING"
        Write-Log "  -> $($Actions.Execute) $($Actions.Arguments)" "WARNING"
    }
}

Write-Log "=== Security Arsenal OTX Threat Hunt Completed ===" "INFO"
Write-Log "Report saved to: $ReportPath" "INFO"

# Summary
$AlertCount = (Select-String -Path $ReportPath -Pattern "ALERT|CRITICAL").Count
if ($AlertCount -gt 0) {
    Write-Host "`n[!] $AlertCount critical findings detected. Immediate investigation required." -ForegroundColor Red
    exit 1
} else {
    Write-Host "`n[+] No immediate threats detected. Continue monitoring." -ForegroundColor Green
    exit 0
}