Fake AI Ads BitB Phishing Platform + Akira Ransomware RDP Intrusion: OTX Pulse Analysis — Enterprise Detection Pack

---
title: Browser-in-the-Browser Phishing Domain Resolution - Fake AI Ads Campaign
id: 7f3a1c2e-9b4d-4e1a-a6c8-2d5f8e0b1a01
status: experimental
description: Detects DNS queries to known Fake AI Ads campaign phishing domains impersonating AI platform advertising products (BitB credential theft)
author: Security Arsenal Threat Intelligence
references:
    - https://www.island.io/blog/behind-the-connect-button-the-fake-ai-ads-campaign
date: 2026/10/08
tags:
    - attack.initial_access
    - attack.t1566
    - attack.t1557
logsource:
    category: dns
detection:
    selection:
        query|contains:
            - 'sync-account.com'
            - 'verification-security.com'
            - 'payment-confirm.com'
            - 'claude-ads.ai'
            - 'claude-advertisers.ai'
            - 'gemini-ads-team.com'
            - 'gemini-advertisers.com'
            - 'manusbymeta.com'
    condition: selection
falsepositives:
    - Threat intelligence validation lookups
level: high
---
title: Rclone Data Exfiltration Execution - Akira Ransomware TTP
id: 8a4b2d3f-0c5e-5f2b-b7d9-3e6a9f1c2b02
status: experimental
description: Detects execution of Rclone with exfiltration-oriented flags or renamed Rclone binaries, consistent with Akira ransomware affiliate data theft
date: 2026/10/08
author: Security Arsenal Threat Intelligence
references:
    - https://www.huntress.com/blog/mapping-akira-ransomware-attack
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith: '\rclone.exe'
        OriginalFileName: 'rclone.exe'
    selection_cmd:
        CommandLine|contains:
            - 'copy '
            - 'sync '
            - 'move '
            - '--transfers'
            - 'mega:'
            - 's3:'
    selection_hash:
        Hashes|contains:
            - 'SHA256=d00833318a04caa019c6f95dcb3598ad947d405010bfb2f3cbd04530a00bc3a4'
            - 'SHA256=1f1bb322591b6d27fd2946e373d7d2efc2f4e1e66818846060d391600b600fba'
    condition: (selection_img and selection_cmd) or selection_hash
falsepositives:
    - Legitimate IT use of Rclone for backup (baseline and whitelist authorized paths/accounts)
level: high
tags:
    - attack.exfiltration
    - attack.t1567.002
---
title: GOST Tunnel Execution or Akira AV Tampering
id: 9b5c3e4a-1d6f-6a3c-c8e0-4f7b0a2d3c03
status: experimental
description: Detects GOST tunneling tool execution for covert persistence and Windows Defender tampering consistent with Akira ransomware intrusions
date: 2026/10/08
author: Security Arsenal Threat Intelligence
references:
    - https://www.huntress.com/blog/mapping-akira-ransomware-attack
logsource:
    category: process_creation
    product: windows
detection:
    selection_gost:
        - Image|endswith: '\gost.exe'
        - CommandLine|contains:
            - '-L socks5://'
            - '-L=ss://'
            - 'relay+tls'
            - '-F '
    selection_av_tamper:
        CommandLine|contains:
            - 'Set-MpPreference -DisableRealtimeMonitoring $true'
            - 'DisableRealtimeMonitoring'
            - 'sc stop WinDefend'
            - 'sc config WinDefend start=disabled'
    selection_net:
        DestinationIp: '64.227.4.134'
    condition: 1 of selection_*
falsepositives:
    - Rare legitimate GOST proxy use by developers
level: critical
tags:
    - attack.command_and_control
    - attack.t1572
    - attack.defense_evasion
    - attack.t1562.001

// Hunt: Fake AI Ads phishing infra + Akira exfil/tunnel behaviors
// Microsoft Sentinel / Defender XDR

// Part 1: Network connections to phishing domains or Akira egress IP
let PhishDomains = dynamic(["sync-account.com","verification-security.com","payment-confirm.com","claude-ads.ai","claude-advertisers.ai","gemini-ads-team.com","gemini-advertisers.com","manusbymeta.com"]);
let AkiraInfra = dynamic(["64.227.4.134"]);
let NetworkHits = DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemoteUrl in~ (PhishDomains) or RemoteIP in (AkiraInfra)
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort;

// Part 2: Rclone / GOST execution with exfil or tunnel flags
let ProcessHits = DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where FileName =~ "rclone.exe" or ProcessVersionInfoOriginalFileName =~ "rclone.exe"
   or FileName =~ "gost.exe"
   or ProcessCommandLine has_any ("--transfers", "mega:", "socks5://", "relay+tls", "DisableRealtimeMonitoring", "sc stop WinDefend")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, SHA256, FolderPath;

// Part 3: RDP logons preceding suspicious process execution (Akira initial access)
let RDPHits = SecurityEvent
| where TimeGenerated > ago(30d)
| where EventID == 4624 and LogonType == 10
| summarize RDPLogons=count(), SourceIPs=make_set(IpAddress) by Account, Computer, bin(TimeGenerated, 1h)
| where RDPLogons > 20 or array_length(SourceIPs) > 3;

union NetworkHits, (ProcessHits | project-rename RemoteUrl=ProcessCommandLine), (RDPHits | project-rename DeviceName=Computer)
| sort by TimeGenerated desc

# Security Arsenal - IOC Hunt: Fake AI Ads Phishing + Akira Ransomware Artifacts
# Run elevated on endpoints/servers. Outputs JSON findings to C:\Temp\OTX_Hunt_Results.json

$ErrorActionPreference = 'SilentlyContinue'
$findings = @()

# --- 1. Phishing domain resolution evidence (DNS client cache) ---
$phishDomains = @('sync-account.com','verification-security.com','payment-confirm.com',
  'claude-ads.ai','claude-advertisers.ai','gemini-ads-team.com','gemini-advertisers.com','manusbymeta.com')
$dnsCache = Get-DnsClientCache | Where-Object { $d = $_.Entry; $phishDomains | Where-Object { $d -like "*$_*" } }
if ($dnsCache) { $findings += [pscustomobject]@{Type='DNS_PhishDomain'; Detail=($dnsCache | Select-Object Entry,Data | ConvertTo-Json -Compress); Host=$env:COMPUTERNAME} }

# --- 2. Akira file hashes on disk (common staging paths) ---
$hashes = @('d00833318a04caa019c6f95dcb3598ad947d405010bfb2f3cbd04530a00bc3a4',
  '1f1bb322591b6d27fd2946e373d7d2efc2f4e1e66818846060d391600b600fba')
$paths = @('C:\Users','C:\ProgramData','C:\Windows\Temp','C:\Temp')
foreach ($p in $paths) {
  Get-ChildItem $p -Recurse -File -Include *.exe,*.dll -ErrorAction SilentlyContinue | ForEach-Object {
    $h = (Get-FileHash $_.FullName -Algorithm SHA256).Hash.ToLower()
    if ($hashes -contains $h) { $findings += [pscustomobject]@{Type='Akira_HashMatch'; Detail=$_.FullName; Host=$env:COMPUTERNAME} }
  }
}

# --- 3. Rclone / GOST binaries (including renamed: match by OriginalFileName) ---
Get-ChildItem 'C:\','D:\' -Recurse -File -Include *.exe -ErrorAction SilentlyContinue | Where-Object {
  $v = $_.VersionInfo; $v.OriginalFilename -match 'rclone|gost' -or $_.Name -match '^(rclone|gost)' 
} | ForEach-Object { $findings += [pscustomobject]@{Type='Exfil_Tunnel_Binary'; Detail="$($_.FullName) | $($_.VersionInfo.OriginalFilename)"; Host=$env:COMPUTERNAME} }

# --- 4. Defender tampering artifacts ---
$mp = Get-MpPreference
if ($mp.DisableRealtimeMonitoring -eq $true) { $findings += [pscustomobject]@{Type='AV_Tamper'; Detail='RealtimeMonitoring disabled via preference'; Host=$env:COMPUTERNAME} }
$defenderSvc = Get-Service WinDefend
if ($defenderSvc.StartType -eq 'Disabled') { $findings += [pscustomobject]@{Type='AV_Tamper'; Detail='WinDefend service disabled'; Host=$env:COMPUTERNAME} }

# --- 5. Persistence: GOST/rclone as services or scheduled tasks ---
Get-CimInstance Win32_Service | Where-Object { $_.PathName -match 'gost|rclone' } | ForEach-Object {
  $findings += [pscustomobject]@{Type='Persistence_Service'; Detail="$($_.Name): $($_.PathName)"; Host=$env:COMPUTERNAME} }
Get-ScheduledTask | Where-Object { ($_.Actions.Execute + $_.Actions.Arguments) -match 'gost|rclone' } | ForEach-Object {
  $findings += [pscustomobject]@{Type='Persistence_SchTask'; Detail=$_.TaskName; Host=$env:COMPUTERNAME} }

# --- 6. Active/recent connections to Akira egress IP ---
Get-NetTCPConnection | Where-Object { $_.RemoteAddress -eq '64.227.4.134' } | ForEach-Object {
  $findings += [pscustomobject]@{Type='Network_AkiraC2'; Detail="$($_.LocalPort) -> 64.227.4.134:$($_.RemotePort) [$($_.State)] PID $($_.OwningProcess)"; Host=$env:COMPUTERNAME} }

# --- 7. RDP exposure check ---
$rdpEnabled = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server').fDenyTSConnections -eq 0
if ($rdpEnabled) { $findings += [pscustomobject]@{Type='RDP_Exposure'; Detail='RDP enabled - verify NLA, MFA, and network restriction'; Host=$env:COMPUTERNAME} }

New-Item -ItemType Directory -Path 'C:\Temp' -Force | Out-Null
$findings | ConvertTo-Json -Depth 4 | Out-File 'C:\Temp\OTX_Hunt_Results.json'
Write-Host "[+] Hunt complete. $($findings.Count) findings -> C:\Temp\OTX_Hunt_Results.json"