FortiBleed Harvesters & Ghost Stadium Phish: OTX Pulse Analysis — Steganography & Credential Theft

---
title: Potential Steganographic Loader Activity
id: 5b0f9c8d-1234-5678-9abc-1a2b3c4d5e6f
description: Detects PowerShell scripts loading image files or using System.Drawing.Bitmap, techniques often used in steganographic loaders like those distributing Agent Tesla or Remcos.
status: experimental
date: 2026/06/26
author: Security Arsenal
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4688
    NewProcessName|endswith: 
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - 'System.Drawing.Bitmap'
      - 'FromBase64String'
      - 'IO.MemoryStream'
  filter:
    CommandLine|contains:
      - 'Microsoft.Update'
      - 'WindowsUpdate'
  condition: selection and not filter
falsepositives:
  - Legitimate administrative scripts
level: high
tags:
  - attack.defense_evasion
  - attack.t1027
  - steganography
---
title: FortiBleed C2 Infrastructure Connection
id: a1b2c3d4-5678-90ab-cdef-1234567890ab
description: Detects network connections to known IP addresses associated with the FortiBleed CyberStrike Harvester campaign.
status: experimental
date: 2026/06/26
author: Security Arsenal
logsource:
  product: zeek
  service: conn
detection:
  selection:
    dest.ip:
      - '85.11.187.8'
      - '193.8.187.42'
  condition: selection
falsepositives:
  - None
level: critical
tags:
  - attack.command_and_control
  - attack.c2
  - fortibleed
---
title: GHOST STADIUM Phishing Domain Access
id: e5f6g7h8-9012-3456-7890-abcdef123456
description: Detects DNS requests or HTTP connections to domains identified in the GHOST STADIUM FIFA World Cup fraud campaign.
status: experimental
date: 2026/06/26
author: Security Arsenal
logsource:
  product: windows
  service: dns
detection:
  selection:
    EventID: 22
    QueryName|contains:
      - 'fifa.gold'
      - 'fifa.black'
      - 'fifa.tax'
      - 'fifaweb.com'
      - 'fifa.red'
      - 'fifa.fund'
  condition: selection
falsepositives:
  - Legitimate FIFA access (unlikely for these specific TLDs)
level: high
tags:
  - attack.initial_access
  - attack.t1566
  - phishing

// Hunt for Ghost Stadium Network Activity and Steganographic Loader Process Creation
let GhostDomains = dynamic(["fifa.gold", "fifa.black", "fifa.tax", "fifaweb.com", "fifa.red", "fifa.fund", "fifa-com.shop", "fifa-com.site"]);
let FortiBleedIPs = dynamic(["85.11.187.8", "193.8.187.42"]);
union DeviceNetworkEvents, DeviceProcessEvents, SecurityEvent
| where TimeGenerated > ago(7d)
| where 
    (RemoteUrl in~ (GhostDomains)) or 
    (RemoteIP has_any (FortiBleedIPs)) or
    (ProcessCommandLine has "System.Drawing.Bitmap") or 
    (ProcessCommandLine has "IO.MemoryStream")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, ProcessCommandLine, RemoteUrl, RemoteIP, ActionType
| extend IoCType = iff(RemoteUrl in~ (GhostDomains), "Ghost Stadium Domain", 
                iff(RemoteIP has_any (FortiBleedIPs), "FortiBleed IP", 
                "Stego Loader Suspicious Process"))

# IOC Hunter for FortiBleed, Stego Loaders, and Ghost Stadium
# Requires Administrative Privileges

Write-Host "[+] Starting IOC Hunt..." -ForegroundColor Cyan

# 1. Check for File Hashes (Stego Loader Samples)
$TargetHashes = @(
    "7f74bb6ba185978134c318bc5f91d23c", # MD5
    "268a8420b791df46380ed9ad69905207e15d8a7c", # SHA1
    "2758f4d71a2a2dfdefab81737c2d776b2a3dafe5844fdd2157e089a28447ca98", # SHA256
    "372f19a45d0eb4c8c52117c6ae2bb8040a91bc72be8670623f957a18c2166985"  # SHA256
)

Write-Host "[*] Scanning for malicious file hashes (C:\ drive only)..." -ForegroundColor Yellow
$Matches = Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue | Get-FileHash -ErrorAction SilentlyContinue | Where-Object { $TargetHashes -contains $_.Hash }
if ($Matches) {
    Write-Host "[!] ALERT: Malicious files found:" -ForegroundColor Red
    $Matches | Format-Table Path, Hash, Algorithm
} else {
    Write-Host "[-] No malicious files found on C:\." -ForegroundColor Green
}

# 2. DNS Cache Check for Ghost Stadium Domains
$BadDomains = @("fifa.gold", "fifa.black", "fifa.tax", "fifaweb.com", "fifa.red", "fifa.fund")
Write-Host "[*] Checking DNS Cache for Ghost Stadium domains..." -ForegroundColor Yellow
$DnsCache = Get-DnsClientCache | Where-Object { $BadDomains -contains $_.Entry }
if ($DnsCache) {
    Write-Host "[!] ALERT: Suspicious DNS cache entries found:" -ForegroundColor Red
    $DnsCache | Format-Table Entry, Data, TimeToLive
} else {
    Write-Host "[-] No suspicious DNS cache entries." -ForegroundColor Green
}

# 3. Active Network Connections for FortiBleed IPs
$BadIPs = @("85.11.187.8", "193.8.187.42")
Write-Host "[*] Checking active TCP connections for FortiBleed IPs..." -ForegroundColor Yellow
$Connections = Get-NetTCPConnection -State Established | Where-Object { $BadIPs -contains $_.RemoteAddress }
if ($Connections) {
    Write-Host "[!] ALERT: Active connections to FortiBleed infrastructure found:" -ForegroundColor Red
    $Connections | Format-Table LocalAddress, RemoteAddress, State, OwningProcess
} else {
    Write-Host "[-] No active connections to FortiBleed IPs." -ForegroundColor Green
}

Write-Host "[+] Hunt complete." -ForegroundColor Cyan