GhostFrame ESXi Implant, CopperDragon Sparrow Framework, and Wpcdoor DVR Side-Loading: OTX Credential-Theft Detection Pack

Three concurrent OTX pulses point to a mature credential-access economy rather than isolated intrusions. TAG-218’s GhostFrame implant turns compromised VMware ESXi hosts into a control plane for VM access, credential harvesting, command execution, and lateral movement ahead of Settra ransomware. CopperDragon operates as a China-nexus quartermaster around the Sparrow ecosystem, using SparrowDoor, CrowDoor, HemiGate, CopperLogger, CopperLsass/CopperLsa, CopperProxy/PyProxy, Melofee, and Reptile to sustain access against government, telecommunications, military, and technology targets across Europe and Asia. Larva-26013 shows the same objective from a different edge: South Korean DVR/CMS software distributing Wpcdoor through DLL side-loading and hVNC, with cryptocurrency theft and credential harvesting called out in the pulse metadata.

Collectively, the attack chain is: breach an exposed management plane or trusted software channel, obtain root/administrator context, stage a loader or implant, abuse legitimate binaries and virtualization/remote-management tooling, harvest LSASS/SAM/browser/VM credentials, then proxy or ransom the environment. The convergence is important for SOC prioritization: edge appliances, DVR/NVR management stations, ESXi/vCenter, and help-desk remote tooling are being used as identity-collection infrastructure, not merely initial-access terrain.

Threat Actor / Malware Profile

TAG-218 / GhostFrame / Settra: post-exploitation framework for VMware ESXi after root-level access. Distribution likely follows exploitation of hypervisor or VPN-appliance weaknesses, including CVE-2026-0257. Behavior centers on unified VM interaction, credential dumping, command execution, and pivoting from the virtualization layer into guest networks. Expect vmdk/datastore access, ESXi shell activity, vmkatz-style credential theft, and possible MeshCentral agent abuse for legitimate-looking remote control. Persistence may live in ESXi boot configuration, cron/init scripts, rogue local users, SSH keys, or guest VM tools.
CopperDragon / Sparrow ecosystem: modular, cross-platform access framework supporting China-nexus operators. Named families span loaders, doors, loggers, LSASS tools, DNS/proxy components, and rootkits: SquadC, SparrowDoor, CrowDoor, HemiGate, TernDoor, AnnobinDoor, SparrowShell, CopperDoor, CopperDNS, CopperAdu, CopperList, CopperLogger, CopperLsa, CopperProxy, PyProxy, CopperLsass, Melofee, Reptile. C2 is infrastructure-heavy across bulletproof/hosting ranges and lookalike domains; identity collection is enabled by LSASS/SAM theft, keylogging, proxy tunneling, and rootkit-assisted stealth.
Larva-26013 / Wpcdoor: supply-chain-style abuse of DVR/CMS software. CMS.exe drops rs.win32.exe plus a malicious IPHLPAPI.DLL loaded by DLL side-loading; stage-one pulls WpcMon.exe and samcli.dll; stage-two executes Wpcdoor in memory. QtCore4.dll and rsaenh.dll are listed as abused/decoy modules. Objectives include hVNC remote control, downloader functionality, cryptocurrency theft, and credential harvesting. Persistence typically hides in Run keys, services, scheduled tasks, and trusted application directories adjacent to CMS binaries.

IOC Analysis

The pulse set contains four operational indicator classes: CVEs, file hashes, IPv4 C2/hosting addresses, and domains. Treat CVE-2026-0257 as an exposure-management trigger for ESXi and adjacent VPN appliances even before exploit confirmation at your site. Hashes such as GhostFrame SHA256 a05eae6d07b82e2e5451a72266f21fbaf76486ef4920a820988de93e15353a10 and Wpcdoor SHA256 8f8e88c54a9c56174974711eff99b4beb79536642fcca1902acdc3d4b1fd1035 are best used in EDR blocklists, retro-hunts, and malware detonation pivots; MD5/SHA1 values are still useful for matching legacy telemetry but should not be the only blocking logic.

Network IOCs including 149.104.12.128, 103.9.77.116, 149.104.87.222, 149.104.90.200, 38.54.57.12, 154.205.154.82, 144.172.116.37, 172.86.127.14, aauctioneer.com, and amelicen.com should be enforced at DNS, proxy, firewall, and EDR network layers, then mined for passive-DNS and NetFlow beaconing. Tooling: MISP/OpenCTI for IOC normalization, VirusTotal/AbuseIPDB/OTX pivots for enrichment, YARA for hash/memory triage, Velociraptor for live response, and Sentinel/Splunk/Elastic for correlation.

Detection Engineering

YAML

---
title: ESXi GhostFrame Credential Harvesting and VM Control
id: 9f0d6a4e-6d28-4d0b-9a4b-gh0stframe001
status: experimental
description: Detects root-level ESXi shell activity consistent with GhostFrame/Settra credential harvesting, VM access, vmkatz-style dumping, and remote-management agent abuse.
references:
  - https://www.recordedfuture.com/jp/blog/ghostframe-esxi-implant-settra-ransomware
author: Security Arsenal
 date: 2026/11/11
logsource:
  product: vmware
  service: esxi
  category: process_creation
detection:
  selection_img:
    Image|endswith:
      - '/vmkatz'
      - '/mimikatz'
      - '/MeshAgent'
      - '/busybox'
      - '/python'
      - '/openssl'
  selection_cli:
    CommandLine|contains:
      - 'vmware-cmd'
      - 'vim-cmd'
      - 'esxcli'
      - 'vsish'
      - 'localcli'
      - 'vmdk'
      - 'vmss'
      - 'suspend'
      - 'snapshot'
      - 'getallvms'
      - 'sam'
      - 'lsass'
      - 'passwd'
      - 'shadow'
      - 'idmef'
      - 'meshcentral'
      - 'socat'
      - 'nc -l'
  selection_exfil:
    CommandLine|contains:
      - 'curl'
      - 'wget'
      - 'scp'
      - 'rsync'
      - 'base64'
      - '/tmp/'
      - '/var/tmp/'
      - 'chmod +x'
  condition: (selection_img and selection_cli) or (selection_img and selection_exfil)
falsepositives:
  - VMware administration via vCenter, backup automation, monitoring agents
level: high
tags:
  - attack.credential_access
  - attack.t1003
  - attack.t1059
  - attack.t1021
  - attack.t1105
---
title: Wpcdoor DVR CMS DLL Side-Loading Chain
id: 7c44c9f5-0f24-4f6a-9d7f-wpcd0or0002
status: experimental
description: Detects Wpcdoor distribution via DVR/CMS software using rs.win32.exe, malicious IPHLPAPI.DLL, WpcMon.exe, samcli.dll, QtCore4.dll, rsaenh.dll, and hVNC-style execution.
references:
  - https://asec.ahnlab.com/ko/96476/
author: Security Arsenal
date: 2026/11/11
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\CMS.exe'
      - '\rs.win32.exe'
      - '\WpcMon.exe'
  selection_child:
    Image|endswith:
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\WpcMon.exe'
  selection_cli:
    CommandLine|contains:
      - 'IPHLPAPI.DLL'
      - 'samcli.dll'
      - 'QtCore4.dll'
      - 'rsaenh.dll'
      - 'hvnc'
      - 'Wpcdoor'
      - 'DownloadString'
      - 'Reflective'
      - 'VirtualAlloc'
      - 'SetWindowsHookEx'
  selection_module:
    ImageLoaded|contains:
      - '\IPHLPAPI.DLL'
      - '\samcli.dll'
      - '\QtCore4.dll'
      - '\rsaenh.dll'
  condition: (selection_parent and selection_child) or (selection_module and selection_cli)
falsepositives:
  - Legitimate DVR CMS updates and vendor-signed IPHLPAPI loads from System32
level: high
tags:
  - attack.defense_evasion
  - attack.t1574
  - attack.t1055
  - attack.credential_access
  - attack.t1003
  - attack.command_and_control
---
title: CopperDragon Sparrow and Wpcdoor C2 Egress
id: 2ab6d7c8-7f53-4dd2-a1d1-sparrowc2003
status: experimental
description: Detects egress to OTX-listed CopperDragon Sparrow infrastructure and Wpcdoor C2 addresses/domains from endpoints, servers, hypervisors, or network sensors.
author: Security Arsenal
date: 2026/11/11
logsource:
  category: firewall
  product: network
detection:
  selection_dst_ip:
    DestinationIp:
      - '149.104.12.128'
      - '103.9.77.116'
      - '149.104.87.222'
      - '149.104.90.200'
      - '38.54.57.12'
      - '154.205.154.82'
      - '144.172.116.37'
      - '172.86.127.14'
  selection_dns:
    query|contains:
      - 'aauctioneer.com'
      - 'amelicen.com'
  selection_sni:
    ssl_sni|contains:
      - 'aauctioneer.com'
      - 'amelicen.com'
  condition: selection_dst_ip or selection_dns or selection_sni
falsepositives:
  - Threat-intel enrichment and sandbox detonation traffic
level: critical
tags:
  - attack.command_and_control
  - attack.t1071
  - attack.t1090
  - attack.t1568

KQL — Microsoft Sentinel / Defender

let C2Ips = dynamic(["149.104.12.128","103.9.77.116","149.104.87.222","149.104.90.200","38.54.57.12","154.205.154.82","144.172.116.37","172.86.127.14"]);
let C2Domains = dynamic(["aauctioneer.com","amelicen.com"]);
let BadFiles = dynamic(["rs.win32.exe","WpcMon.exe","CMS.exe","vmkatz","MeshAgent","SparrowDoor","CrowDoor","CopperLogger","CopperLsass","CopperLsa","PyProxy"]);
let BadModules = dynamic(["IPHLPAPI.DLL","samcli.dll","QtCore4.dll","rsaenh.dll"]);
union isfuzzy=true
(DeviceNetworkEvents
| where RemoteIP in~ (C2Ips) or RemoteUrl has_any (C2Domains)
| project TimeGenerated, DeviceName, RemoteIP, RemoteUrl, RemotePort, InitiatingProcessFileName, InitiatingProcessCommandLine, ActionType),
(DeviceProcessEvents
| where FileName in~ (BadFiles) or ProcessCommandLine has_any (BadFiles) or ProcessCommandLine has_any (BadModules)
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256),
(DeviceImageLoadEvents
| where FileName in~ (BadModules) or FolderPath has_any (BadModules)
| project TimeGenerated, DeviceName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256)
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Hits=count(), Artifacts=make_set(pack("proc", tostring(FileName), "cmd", tostring(ProcessCommandLine), "ip", tostring(RemoteIP), "url", tostring(RemoteUrl), "mod", tostring(FolderPath)), 50) by DeviceName
| order by Hits desc;

PowerShell

$ErrorActionPreference = 'SilentlyContinue'
$now = Get-Date
$c2 = @('149.104.12.128','103.9.77.116','149.104.87.222','149.104.90.200','38.54.57.12','154.205.154.82','144.172.116.37','172.86.127.14')
$domains = @('aauctioneer.com','amelicen.com')
$procNames = @('rs.win32','WpcMon','CMS','vmkatz','MeshAgent','SparrowDoor','CrowDoor','HemiGate','TernDoor','AnnobinDoor','SparrowShell','CopperDoor','CopperLogger','CopperLsass','CopperLsa','PyProxy','Melofee')
$moduleNames = @('IPHLPAPI.DLL','samcli.dll','QtCore4.dll','rsaenh.dll')
$paths = @(
 "$env:ProgramFiles\DVR","$env:ProgramFiles(x86)\DVR","$env:ProgramData\CMS","$env:ProgramData\WpcMon",
 "$env:LOCALAPPDATA\Temp\rs.win32.exe","$env:TEMP\IPHLPAPI.DLL","$env:TEMP\samcli.dll","$env:TEMP\QtCore4.dll","$env:TEMP\rsaenh.dll",
 'C:\Windows\Temp\rs.win32.exe','C:\Windows\Temp\WpcMon.exe','C:\Windows\System32\Tasks\WpcMon'
)
"=== Host: $env:COMPUTERNAME | $now ==="
"--- Live processes / loaded modules ---"
Get-Process | Where-Object { $p=$_; ($procNames | Where-Object { $p.ProcessName -like "*$_*" }) -or ($p.Modules | Where-Object { $mn=$_.ModuleName; $moduleNames | Where-Object { $mn -like "*$_*" } }) } |
 Select-Object ProcessName,Id,Path,StartTime | Format-Table -AutoSize
"--- Network connections to pulse C2 ---"
Get-NetTCPConnection | Where-Object { $c2 -contains $_.RemoteAddress -or $_.State -eq 'Listen' -and $_.LocalPort -in 443,8443,8080,9001 } |
 Select-Object LocalAddress,LocalPort,RemoteAddress,RemotePort,State,OwningProcess | Format-Table -AutoSize
"--- DNS cache hits for pulse domains ---"
Get-DnsClientCache | Where-Object { $d=$_.Entry; $domains | Where-Object { $d -like "*$_*" } } | Format-Table -AutoSize
"--- Persistence: Run keys, services, tasks, WMI ---"
$runKeys = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run','HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run','HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'
foreach ($k in $runKeys) { Get-ItemProperty $k | ForEach-Object { $_.PSObject.Properties | Where-Object { $_.Value -match 'rs\.win32|WpcMon|CMS\.exe|MeshAgent|Copper|Sparrow|PyProxy|IPHLPAPI|samcli' } | Select-Object PSPath,Name,Value } }
Get-CimInstance Win32_Service | Where-Object { $_.PathName -match 'rs\.win32|WpcMon|MeshAgent|Copper|Sparrow|PyProxy|Temp|ProgramData' } | Select-Object Name,State,StartMode,PathName | Format-List
Get-ScheduledTask | Where-Object { $_.Actions.Execute -match 'rs\.win32|WpcMon|CMS\.exe|powershell|mshta|rundll32' -or $_.TaskName -match 'Wpc|DVR|CMS|Mesh|Copper|Sparrow' } | Select-Object TaskName,TaskPath,State | Format-Table -AutoSize
"--- Suspicious files ---"
foreach ($p in $paths) { if (Test-Path $p) { Get-Item $p -Force | Select-Object FullName,Length,CreationTime,LastWriteTime } }
Get-ChildItem "$env:SystemRoot\System32","$env:SystemRoot\SysWOW64","$env:ProgramData","$env:TEMP" -Recurse -Force -ErrorAction SilentlyContinue |
 Where-Object { $moduleNames -contains $_.Name -or $procNames | Where-Object { $_.Name -like "*$n*" } } |
 Select-Object FullName,Length,CreationTime,LastWriteTime | Format-Table -AutoSize
"--- Local identity artifacts ---"
Get-LocalUser | Where-Object { $_.Name -match 'mesh|support|dvr|cms|admin$|svc' -or $_.LastLogon -gt ($now.AddDays(-7)) } | Select-Object Name,Enabled,LastLogon | Format-Table -AutoSize
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624,4625,4648,4672,4688; StartTime=$now.AddHours(-24)} | Where-Object { $_.Message -match 'WpcMon|rs.win32|CMS.exe|MeshAgent|lsass|samcli|IPHLPAPI|149.104|144.172|172.86' } | Select-Object TimeCreated,Id,Message | Format-List

Response Priorities

Immediate: Block listed hashes, IPs, and domains at EDR, DNS, proxy, firewall, and cloud egress. Isolate ESXi hosts, DVR/CMS management stations, and endpoints showing WpcMon/rs.win32/MeshAgent/Sparrow execution. Capture memory before reboot; preserve ESXi logs, shell histories, vCenter events, datastore file listings, and Windows image-load telemetry. Disable ESXi shell/SSH where not required and rotate root, vCenter SSO, local admin, VPN, and service-account secrets if any hypervisor or CMS host is suspect.
24h: Assume identity compromise if LSASS/SAM/VM credential access is possible. Force enterprise password resets for admins and users with sessions on impacted hosts, revoke tokens/cookies, invalidate API keys, re-enroll MFA for high-risk accounts, and review mailbox/OAuth consent. Hunt Kerberos anomalies, unusual vCenter logons, new ESXi local users/SSH keys, and outbound 443/8443 beaconing to the listed AS46261/AS8100 and CopperDragon ranges.
1 week: Patch or compensate for CVE-2026-0257 exposure and lock down VPN appliances and DVR/CMS vendors. Remove ESXi from flat network reachability, require jump-host plus phishing-resistant MFA for vCenter, enable VM encryption/secure boot where feasible, and separate backup control planes. Constrain DLL search paths, enforce WDAC/AppLocker for CMS directories, disable unsigned side-loadable modules, monitor MeshCentral/remote-tools allowlists, and add hypervisor telemetry to the SIEM data lake.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub