Gorbag Espionage on Ukraine, Rogue Gentlemen Affiliate 'Azazel' & XWorm RAT: OTX Pulse Detection Pack

---
title: WinRAR CVE-2025-8088 Archive Traversal Drop to Startup - Gorbag
id: 8f1e2c3a-11b4-4f6a-9d2e-gorbag000001
status: experimental
description: Detects WinRAR/unrar extraction writing executables or scripts to Startup or Temp paths, consistent with Gorbag's CVE-2025-8088 delivery of GIFTEDCROOK/BeautyStealer.
author: Security Arsenal
logsource:
  category: file_event
  product: windows
  definition: file_event
references:
  - https://www.welivesecurity.com/en/eset-research/gorbag-orcs-border-harvesting-intelligence-ukraine/
date: 2026/11/04
tags:
  - attack.initial_access
  - attack.t1189
  - attack.t1060
detection:
  selection_source:
    Image|endswith:
      - '\winrar.exe'
      - '\unrar.exe'
      - '\7z.exe'
      - '\7zg.exe'
  selection_target_path:
    TargetFilename|contains:
      - '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\'
      - '\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\'
      - '\AppData\Local\Temp\'
  selection_ext:
    TargetFilename|endswith:
      - '.exe'
      - '.dll'
      - '.bat'
      - '.ps1'
      - '.lnk'
      - '.vbs'
  condition: selection_source and selection_target_path and selection_ext
falsepositives:
  - Legitimate software extraction to Temp by installers
level: high
---
title: XWorm RAT Dynamic DNS C2 Communication
id: 9a2f3d4b-22c5-5a7b-8e3f-xworm000002
status: experimental
description: Detects DNS queries or network connections to dynamic-DNS providers observed hosting XWorm C2 infrastructure.
author: Security Arsenal
logsource:
  category: dns
  product: windows
  definition: dns_query
references:
  - https://cyberint.com/blog/dark-web/xworm-malware-worming-its-way-from-entry-to-exploitation/
date: 2026/11/04
tags:
  - attack.command_and_control
  - attack.t1071
detection:
  selection_ioc:
    query|contains:
      - '09090clami09090930032.duckdns.org'
      - 'loganwolverin2042.webredirect.org'
  selection_dyndns:
    query|endswith:
      - '.duckdns.org'
      - '.webredirect.org'
      - '.hopto.org'
      - '.no-ip.org'
  filter_common:
    Image|endswith:
      - '\svchost.exe'
    query|contains:
      - 'microsoft'
      - 'windows'
  condition: selection_ioc or (selection_dyndns and not filter_common)
falsepositives:
  - Legitimate self-hosted services using dynamic DNS (rare in enterprise endpoints)
level: high
---
title: Suspicious GitLab Credential Access or CI/CD Secret Harvesting - Gentlemen Affiliate Activity
id: 7b3e4f5c-33d6-6b8c-9f4a-gitlab000003
status: experimental
description: Detects processes accessing GitLab configuration, CI/CD variable files, or credential stores, plus connections to the phishing domain forgitlab.com.
author: Security Arsenal
logsource:
  category: process_creation
  product: windows
  definition: process_creation_cmdline
references:
  - https://www.cloudsek.com/blog/caught-in-4k-the-gentlemen-files
date: 2026/11/04
tags:
  - attack.credential_access
  - attack.t1552
detection:
  selection_paths:
    CommandLine|contains:
      - '.gitlab-credentials'
      - 'gitlab.rb'
      - 'config.toml'
      - 'GITLAB_TOKEN'
      - 'CI_JOB_TOKEN'
      - 'forgitlab.com'
  selection_tools:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\findstr.exe'
      - '\type.exe'
      - '\cat.exe'
  filter_gitlab_runner:
    Image|endswith:
      - '\gitlab-runner.exe'
  condition: selection_paths and selection_tools and not filter_gitlab_runner
falsepositives:
  - DevOps engineers legitimately inspecting runner configs (tune per environment)
level: medium

// XWorm C2 + Gorbag C2 retro-hunt (Microsoft Sentinel / Defender XDR)
let GorbagC2 = dynamic(["89.44.9.186", "142.111.194.73"]);
let XWormDynDNS = dynamic(["09090clami09090930032.duckdns.org", "loganwolverin2042.webredirect.org"]);
let DynDNSProviders = dynamic(["duckdns.org", "webredirect.org", "hopto.org", "no-ip.org"]);
union isfuzzy=true
(DeviceNetworkEvents
 | where TimeGenerated > ago(30d)
 | where RemoteIP in (GorbagC2) or RemoteUrl has_any (XWormDynDNS)
 | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort, ActionType),
(DeviceNetworkEvents
 | where TimeGenerated > ago(30d)
 | where RemoteUrl endswith_any (DynDNSProviders)
 | where InitiatingProcessFileName !in~ ("svchost.exe", "msedge.exe", "chrome.exe", "firefox.exe")
 | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort, ActionType),
(DeviceProcessEvents
 | where TimeGenerated > ago(30d)
 | where ProcessCommandLine has_any (".gitlab-credentials", "GITLAB_TOKEN", "CI_JOB_TOKEN", "forgitlab.com")
 | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, AccountName, InitiatingProcessFileName)
| order by TimeGenerated desc

# Security Arsenal - Combined IOC & Persistence Hunt (Gorbag / XWorm / GitLab phishing)
# Run elevated on endpoints; review $report output
$report = @()

# 1. Gorbag C2 + known bad connections
$badIPs = @("89.44.9.186", "142.111.194.73")
Get-NetTCPConnection | Where-Object { $badIPs -contains $_.RemoteAddress } | ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    $report += [pscustomobject]@{Type="BadIP-Connection"; Detail="$($_.RemoteAddress):$($_.RemotePort) via $($proc.ProcessName) ($($proc.Path))"}
}

# 2. XWorm persistence - Run keys with suspicious values
$runKeys = @(
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run"
)
foreach ($key in $runKeys) {
    if (Test-Path $key) {
        Get-ItemProperty $key | Get-Member -MemberType NoteProperty | ForEach-Object {
            $val = (Get-ItemProperty $key).($_.Name)
            if ($val -match "AppData|Temp|Roaming|\.ps1|\.vbs|regsvr32|rundll32") {
                $report += [pscustomobject]@{Type="RunKey-Suspicious"; Detail="$key :: $($_.Name) = $val"}
            }
        }
    }
}

# 3. Scheduled tasks executing from user-writable paths
Get-ScheduledTask | ForEach-Object {
    $actions = $_.Actions | Where-Object { $_.Execute -match "AppData|Temp|Public" }
    if ($actions) {
        $report += [pscustomobject]@{Type="ScheduledTask-Suspicious"; Detail="$($_.TaskName) -> $($actions.Execute) $($actions.Arguments)"}
    }
}

# 4. Startup folder payloads (CVE-2025-8088 drop location)
$startupPaths = @(
    "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup",
    "$env:ProgramData\Microsoft\Windows\Start Menu\Programs\Startup"
)
foreach ($p in $startupPaths) {
    if (Test-Path $p) {
        Get-ChildItem $p -File | Where-Object { $_.Extension -in ".exe",".dll",".bat",".ps1",".lnk",".vbs" } | ForEach-Object {
            $report += [pscustomobject]@{Type="StartupPayload"; Detail="$($_.FullName) | Created: $($_.CreationTime)"}
        }
    }
}

# 5. GitLab credential exposure on disk (Azazel/Gentlemen vector)
$gitlabArtifacts = @("$env:USERPROFILE\.gitlab-credentials", "C:\gitlab-runner\config.toml")
foreach ($g in $gitlabArtifacts) {
    if (Test-Path $g) {
        $report += [pscustomobject]@{Type="GitLab-Secret-OnDisk"; Detail="$g present - verify access logs and rotate tokens"}
    }
}

# 6. Known malicious file hashes (sample from pulses)
$badHashes = @("583754e5e682ea83d58fbf76ea5c82ea0f2ab5db06e9e52343c4d52f35f0a4a6",
               "5f63fe34d77b1eff07a9eef9d7ca1df2537aa90cb1d3fc2e215086d2397313c5",
               "ce02802067934e0eb072f69bf6427bf6")
foreach ($dir in @("$env:TEMP", "$env:APPDATA", "$env:LOCALAPPDATA")) {
    Get-ChildItem $dir -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
        $h = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
        $hm = (Get-FileHash $_.FullName -Algorithm MD5 -ErrorAction SilentlyContinue).Hash
        if ($badHashes -contains $h.ToLower() -or $badHashes -contains $hm.ToLower()) {
            $report += [pscustomobject]@{Type="MaliciousHash"; Detail="$($_.FullName) matched pulse IOC"}
        }
    }
}

$report | Format-Table -AutoSize
$report | Export-Csv "$env:TEMP\otx_hunt_$(Get-Date -Format yyyyMMdd_HHmm).csv" -NoTypeInformation