Fake Corepack Supply Chain Attack: OpenShield & Apprunner Distribution

---
title: Fake Corepack Site Domain Connection
id: 8c7e2f1a-9b4c-4c5d-8e2f-1a9b4c4c5d8e
status: experimental
description: Detects network connections to the known typosquatted Corepack domain and associated infrastructure used for malware distribution.
references:
    - https://otx.alienvault.com/
author: Security Arsenal
date: 2026/07/27
tags:
    - attack.command_and_control
    - attack.t1071.001
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Initiated: 'true'
        DestinationHostname|contains:
            - 'corepack.org'
            - 'yakteam.xyz'
            - 'canatrace.com'
    condition: selection
falsepositives:
    - Legitimate developer traffic (unlikely given the nature of the domains)
level: critical
---
title: OpenShield Malware Payload Download
id: 9d8f3b2c-0c5d-5d6e-9f3b-2c0c5d5d6e9f
status: experimental
description: Detects attempts to download executables or scripts from the specific OpenShield payload URL path.
references:
    - https://otx.alienvault.com/
author: Security Arsenal
date: 2026/07/27
tags:
    - attack.initial_access
    - attack.t1189
logsource:
    category: proxy
    product: null
detection:
    selection:
        c-uri|contains: 'download-free-can'
        c-hostname|contains: 'canatrace.com'
    condition: selection
falsepositives:
    - Unknown
level: high
---
title: Suspicious Corepack Installer Execution
id: 0e1g4c3d-1d6e-6e7f-0e1g-4c1d6e6e7f0e
status: experimental
description: Detects execution of processes with names related to Corepack originating from suspicious user directories or download folders, indicative of the fake installer.
references:
    - https://otx.alienvault.com/
author: Security Arsenal
date: 2026/07/27
tags:
    - attack.execution
    - attack.t1204
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\corepack.exe'
            - '\corepack-setup.exe'
    selection_loc:
        ParentImage|contains:
            - '\Downloads\'
            - '\Desktop\'
            - '\Temp\'
    condition: all of selection_*
falsepositives:
    - Legitimate installation of Corepack by developers (verify parent process and signing)
level: medium

// Hunt for network connections to identified IOCs
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has "corepack.org" 
   or RemoteUrl has "yakteam.xyz" 
   or RemoteUrl has "canatrace.com"
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP

// Hunt for process creation related to the payload URLs
DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessCommandLine has "freevpn.win" or ProcessCommandLine has "openshield.canatrace.com"
| project Timestamp, DeviceName, FileName, ProcessCommandLine, FolderPath, InitiatingProcessAccountName

# IOC Hunt Script for Fake Corepack Campaign
# Checks DNS Cache and Hosts File for malicious indicators

$MaliciousIndicators = @(
    "corepack.org",
    "yakteam.xyz",
    "freevpn.win",
    "canatrace.com"
)

Write-Host "[+] Checking DNS Cache for malicious domains..." -ForegroundColor Cyan
$DnsCache = Get-DnsClientCache | Where-Object { $MaliciousIndicators -like "*$($_.Entry)*" }

if ($DnsCache) {
    Write-Host "[!] ALERT: Found suspicious entries in DNS Cache:" -ForegroundColor Red
    $DnsCache | Format-Table Entry, Data, TimeToLive
} else {
    Write-Host "[-] No suspicious DNS cache entries found." -ForegroundColor Green
}

Write-Host "`n[+] Checking Hosts File for malicious indicators..." -ForegroundColor Cyan
$HostsPath = "$env:SystemRoot\System32\drivers\etc\hosts"
if (Test-Path $HostsPath) {
    $HostsContent = Get-Content $HostsPath | Select-String -Pattern ($MaliciousIndicators -join '|')
    if ($HostsContent) {
        Write-Host "[!] ALERT: Found suspicious entries in Hosts file:" -ForegroundColor Red
        $HostsContent
    } else {
        Write-Host "[-] No suspicious Hosts file entries found." -ForegroundColor Green
    }
}

Write-Host "`n[+] Checking for recent Corepack related executables in user directories..." -ForegroundColor Cyan
$PotentialExecutables = Get-ChildItem -Path "C:\Users\*" -Filter "corepack*.exe" -Recurse -ErrorAction SilentlyContinue | Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) }
if ($PotentialExecutables) {
    Write-Host "[!] ALERT: Found recently created Corepack executables:" -ForegroundColor Red
    $PotentialExecutables | Format-Table FullName, LastWriteTime, Length
} else {
    Write-Host "[-] No suspicious executables found." -ForegroundColor Green
}