Back to Intelligence

Gorbag GIFTEDCROOK/BeautyStealer Ukraine Espionage + Malicious Claude Code Extension SSH Backdoor + Gentlemen RaaS 'Azazel' GitLab CI/CD Credential Theft: OTX Detection Pack

SA
Security Arsenal Team
November 4, 2026
10 min read

These three OTX pulses collectively point to one converging enterprise risk: credential and secret theft as the fastest path to impact, whether the end goal is wartime espionage, developer workstation compromise, or ransomware extortion.

First, the Russia-aligned actor Gorbag is running highly targeted cyberespionage against Ukrainian government, justice, law enforcement, front-line administrations, transportation, and defense organizations. The reported tradecraft favors speed over dwell time: spearphishing and exploitation (including CVE-2025-8088) to deliver lightweight infostealers and reverse shell tooling such as BeautyStealer, GIFTEDCROOK, and Prime ReverseShell, with infrastructure hosted on commodity VPS providers.

Second, Microsoft details a supply-chain style developer compromise: a trojanized Claude Code-branded extension published to the Cursor marketplace (versions 2.1.313 and 2.1.312) during a limited distribution window. The injected JavaScript executes during module load, performs host reconnaissance, and installs a persistent SSH backdoor on macOS using LaunchAgent-style persistence and system plist manipulation (aligned to the reported detections Trojan:MacOS/SmtShellMal.A, Trojan:MacOS/MalPlistSysmond.A, HackTool:MacOS/RevAnthShell.A, and Trojan:JS/CredTheft.MS!MTB).

Third, CloudSEK reporting on the Gentlemen ransomware ecosystem shows an affiliate (Azazel) compromising organizations across logistics, finance, healthcare, technology, and government, then splitting from the RaaS operator by running an independent leak site (LEAKNED) to keep proceeds. The most important enterprise lesson is the initial access and expansion mechanism: harvesting CI/CD secrets from GitLab instances and using them to move laterally, access production systems, and stage exfiltration. The listed domain indicator forgitlab.com is consistent with infrastructure used to imitate or target GitLab-dependent workflows.

Across all three pulses, the defensive priority is the same: detect secret access, unexpected outbound tunnels, and persistence that survives reboot, then rapidly contain identity and CI/CD exposure before follow-on deployment.

Threat Actor / Malware Profile

Gorbag (Russia-aligned) — GIFTEDCROOK / BeautyStealer / Prime ReverseShell

  • Distribution method: Targeted spearphishing against Ukrainian entities; exploitation of CVE-2025-8088 is explicitly tagged, suggesting vulnerability-assisted delivery in at least some operations.
  • Payload behavior: Rapid collection of high-value data (credentials, browser-stored secrets, documents, and system context) to enable quick intelligence gain rather than long-term stealth.
  • C2 communication: Infrastructure includes VPS-hosted IPv4 indicators (example: 89.44.9.186, AS9009 / M247). Expect HTTP(S) or simple TCP-based beaconing typical of lightweight stealers and reverse shells.
  • Persistence mechanism: Not consistently emphasized for this actor set; reverse shell components may be used for on-demand access and re-entry.
  • Anti-analysis techniques: Likely includes short-lived staging, minimal payloads, and commodity hosting to blend into normal VPS traffic; hash diversity (MD5/SHA1/SHA256) indicates multiple builds or packaging variants.

Malicious Claude Code-Branded Cursor Extension — JS Loader + macOS SSH Backdoor

  • Distribution method: Supply-chain style delivery via a compromised extension published in a developer marketplace (Cursor), versions 2.1.312/2.1.313, during a bounded exposure window.
  • Payload behavior: JavaScript runs during module loading, collects host reconnaissance, and installs a persistent backdoor.
  • C2 communication: Reverse tunneling and SSH-based remote access (consistent with “persistent SSH backdoor” and the RevAnthShell hacktool naming).
  • Persistence mechanism: macOS persistence consistent with LaunchAgent behavior and plist-based execution (e.g., ~/Library/LaunchAgents, /Library/LaunchDaemons), matching MalPlistSysmond detections.
  • Anti-analysis techniques: Blends into developer tooling; executes inside trusted processes (IDE/extension host), which can bypass simplistic application allowlists and reduce user suspicion.

Gentlemen RaaS Affiliate “Azazel” — GitLab Secrets-Driven Intrusion + Double Extortion

  • Distribution method: Not phishing-first; the emphasized vector is abuse of exposed or poorly protected GitLab CI/CD variables, access tokens, and repository secrets.
  • Payload behavior: Uses harvested secrets to access internal systems, pull additional credentials, and stage data theft; extortion is amplified by an independent leak site.
  • C2 communication: Variable by stage, but the key early signal is abnormal access to GitLab from unusual networks and unexpected use of tokens in automation contexts.
  • Persistence mechanism: Persistence is typically achieved through credential retention (new tokens, deploy keys, runner registrations) rather than endpoint malware alone.
  • Anti-analysis techniques: “Living off the pipeline” — using legitimate CI/CD tooling and valid credentials reduces classic malware artifacts and increases dwell time unless identity and pipeline telemetry are monitored.

IOC Analysis

These pulses contain four high-value IOC classes: IPv4 infrastructure, domains, file hashes, and a CVE reference.

  • IPv4 (example: 89.44.9.186, 142.111.194.73): Treat as potential C2, staging, or reverse-shell endpoints. Operationalize by blocking at egress proxy/firewall, adding to EDR network indicators, and retro-hunting NetFlow/proxy/DNS logs for the last 14–30 days (longer for espionage targets).
  • Domain (forgitlab.com): Treat as a GitLab-themed lookalike or supporting domain. Block at DNS and secure web gateway, then hunt for endpoint DNS queries and TLS SNI matches. Investigate any GitLab authentication events around first-seen query timestamps.
  • File hashes (MD5/SHA1/SHA256): Best used for retro-hunt and confirmation, not prevention. Push SHA256 values into EDR block lists where possible, and search for hash matches across email detonation, proxy download logs, and endpoint file inventory.
  • CVE (CVE-2025-8088): Treat as a priority patch/verification item. If you cannot immediately patch, implement compensating controls (virtual patching at WAF/IPS, restrict exposure, increase logging) and hunt for exploitation attempts.

Tooling that operationalizes these well:

  • EDR/XDR for hash + behavior correlation (Microsoft Defender for Endpoint, CrowdStrike, SentinelOne).
  • SIEM/SOAR for IOC enrichment and retro-hunting (Sentinel, Splunk, Elastic).
  • DNS/Proxy controls for domain and IP enforcement (Zscaler, Palo Alto, Cisco Umbrella, Cloudflare Gateway).

Detection Engineering

YAML
---
title: Gorbag Infostealer or Reverse Shell Network Beacon to OTX Infrastructure
id: 9f1a3f5e-7c0b-4d6c-9c8f-0d2f9a6f2d71
status: experimental
description: Detects outbound connections to OTX-listed infrastructure associated with Gorbag (BeautyStealer/GIFTEDCROOK/Prime ReverseShell) activity.
author: Security Arsenal
references:
  - https://otx.alienvault.com/
logsource:
  category: network_connection
  product: windows
detection:
  selection_ip:
    DestinationIp:
      - "89.44.9.186"
      - "142.111.194.73"
  condition: selection_ip
fields:
  - Image
  - ProcessId
  - DestinationIp
  - DestinationPort
  - Initiated
falsepositives:
  - Rare; validate any business dependency on the listed VPS ranges.
level: high
tags:
  - attack.command_and_control
  - attack.exfiltration
  - cve.2025-8088
  - tlp.white
date: 2026/11/04
---
title: Suspicious SSH Reverse Tunnel Execution (Developer Workstations / macOS Backdoor Pattern)
id: 0a6a2f62-1d1a-4c8b-9f2a-9f5a0d6a3a0a
status: experimental
description: Detects ssh invocations consistent with reverse tunneling (-R) and common persistence-friendly flags, matching behavior described in the malicious Claude Code-branded extension report.
author: Security Arsenal
references:
  - https://www.microsoft.com/en-us/security/blog/
logsource:
  category: process_creation
  product: macos
detection:
  selection_img:
    Image|endswith:
      - "/ssh"
      - "/autossh"
  selection_args:
    CommandLine|contains:
      - " -R "
      - " -N "
      - " -f "
      - "ServerAliveInterval"
      - "ExitOnForwardFailure"
  condition: selection_img and selection_args
fields:
  - Image
  - CommandLine
  - ParentImage
  - User
falsepositives:
  - Legitimate admin tunnels; validate with change tickets and approved tooling.
level: medium
tags:
  - attack.command_and_control
  - attack.persistence
  - attack.tunneling
  - tlp.white
date: 2026/11/04
---
title: macOS LaunchAgent Persistence Creation in User Library (Credential Theft + Backdoor Persistence)
id: 7a5d0a3f-6f7c-4b6d-9f1b-8d3f0a2b1c99
status: experimental
description: Detects creation of LaunchAgent plist files under user LaunchAgents directories, a common persistence mechanism for macOS credential theft and SSH backdoors.
author: Security Arsenal
references:
  - https://otx.alienvault.com/
logsource:
  category: file_event
  product: macos
detection:
  selection_path:
    TargetFileName|contains:
      - "/Library/LaunchAgents/"
  selection_ext:
    TargetFileName|endswith:
      - ".plist"
  condition: selection_path and selection_ext
fields:
  - TargetFileName
  - Image
  - User
  - ProcessId
falsepositives:
  - Legitimate software installs; correlate with unsigned binaries, unexpected parent processes, and recent extension installs.
level: medium
tags:
  - attack.persistence
  - attack.privilege_escalation
  - attack.t1543.001
  - attack.t1543.004
  - tlp.white
date: 2026/11/04
KQL — Microsoft Sentinel / Defender
// Sentinel hunt: OTX IOC matches + SSH reverse tunnel behavior + GitLab-themed domain lookups
// Time window: adjust to your retention and exposure window
let Lookback = 14d;
let SuspiciousIPs = dynamic(["89.44.9.186","142.111.194.73"]);
let SuspiciousDomains = dynamic(["forgitlab.com"]);
// 1) Network IOC hits (EDR network events)
let NetIOC =
DeviceNetworkEvents
| where TimeGenerated >= ago(Lookback)
| where RemoteIP in (SuspiciousIPs) or RemoteUrl has_any (SuspiciousDomains)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemotePort, RemoteUrl, ActionType;
// 2) Process behavior: ssh reverse tunnel flags (Windows/Linux/macOS via MDE process telemetry)
let ReverseTunnel =
DeviceProcessEvents
| where TimeGenerated >= ago(Lookback)
| where FileName =~ "ssh" or FileName =~ "ssh.exe" or FileName =~ "autossh"
| where ProcessCommandLine has_any (" -R ", " -N ", " -f ", "ServerAliveInterval", "ExitOnForwardFailure")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine;
// 3) File hash hits (hash IOCs from pulses)
let HashIOC =
union isfuzzy=true
  (DeviceFileEvents
    | where TimeGenerated >= ago(Lookback)
    | where SHA256 in (dynamic([
        "583754e5e682ea83d58fbf76ea5c82ea0f2ab5db06e9e52343c4d52f35f0a4a6",
        "7e0a52885fadee05544a9e99eb18c792bec05900a5e1a66d68f8383decb0e278",
        "ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15"
      ]))
    | project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine),
  (DeviceProcessEvents
    | where TimeGenerated >= ago(Lookback)
    | where SHA256 in (dynamic([
        "583754e5e682ea83d58fbf76ea5c82ea0f2ab5db06e9e52343c4d52f35f0a4a6",
        "7e0a52885fadee05544a9e99eb18c792bec05900a5e1a66d68f8383decb0e278",
        "ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15"
      ]))
    | project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine)
);
// Output
NetIOC
| union isfuzzy=true (ReverseTunnel | extend RemoteIP="", RemotePort=0, RemoteUrl="", ActionType="", SHA256="", FolderPath="")
| union isfuzzy=true (HashIOC | extend AccountName="", ProcessCommandLine="", RemoteIP="", RemotePort=0, RemoteUrl="", ActionType="", InitiatingProcessFileName="")
| order by TimeGenerated desc
PowerShell
# Hunt Script (Windows + macOS/Linux where PowerShell 7+ is deployed)
# Checks: OTX IPs/domains, suspicious SSH reverse tunnel processes, macOS LaunchAgents, and IOC hash presence (best effort)

param(
  [int]$LookbackDays = 14,
  [string]$HashSearchRoot = "C:\"
)

$ErrorActionPreference = "SilentlyContinue"

$SuspiciousIPs = @("89.44.9.186","142.111.194.73")
$SuspiciousDomains = @("forgitlab.com")
$SHA256 = @(
  "583754e5e682ea83d58fbf76ea5c82ea0f2ab5db06e9e52343c4d52f35f0a4a6",
  "7e0a52885fadee05544a9e99eb18c792bec05900a5e1a66d68f8383decb0e278",
  "ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15"
)

Write-Host "=== [1] Active network connections matching OTX IPs ==="
$conns = Get-NetTCPConnection | Where-Object { $SuspiciousIPs -contains $_.RemoteAddress }
$conns | Format-Table -AutoSize

Write-Host "`n=== [2] Processes with SSH reverse-tunnel style arguments ==="
Get-CimInstance Win32_Process |
  Where-Object { $_.Name -match "ssh|autossh" -and $_.CommandLine -match "\s-R\s|\s-N\s|\s-f\s|ServerAliveInterval|ExitOnForwardFailure" } |
  Select-Object ProcessId, Name, CommandLine, ParentProcessId |
  Format-List

Write-Host "`n=== [3] macOS persistence artifacts (if running on macOS): LaunchAgents/LaunchDaemons ==="
$launchPaths = @("/Library/LaunchAgents","/Library/LaunchDaemons","$HOME/Library/LaunchAgents")
foreach ($p in $launchPaths) {
  if (Test-Path $p) {
    Write-Host "--- $p (recent .plist files) ---"
    Get-ChildItem $p -Filter *.plist | Sort-Object LastWriteTime -Descending |
      Select-Object -First 25 FullName, LastWriteTime | Format-Table -AutoSize
  }
}

Write-Host "`n=== [4] DNS cache hints for suspicious domains (Windows) ==="
if ($IsWindows) {
  Get-DnsClientCache | Where-Object { $_.Entry -match ($SuspiciousDomains -join "|") } |
    Select-Object Entry, Data, TimeToLive | Format-Table -AutoSize
}

Write-Host "`n=== [5] File hash search (may be slow; adjust HashSearchRoot) ==="
# Note: For enterprise use, prefer EDR-based hash sweeps. This is a fallback.
$found = @()
Get-ChildItem -Path $HashSearchRoot -Recurse -File -Force |
  ForEach-Object {
    $h = (Get-FileHash $_.FullName -Algorithm SHA256).Hash
    if ($SHA256 -contains $h) { $found += [pscustomobject]@{Path=$_.FullName; SHA256=$h} }
  }
$found | Format-List

Write-Host "`n=== Done. If hits occur: isolate host, capture triage, and rotate exposed credentials/secrets. ==="

Response Priorities

Immediate (0–24 hours)

  • Block and alert on network IOCs: 89.44.9.186, 142.111.194.73, and forgitlab.com at DNS, proxy, and egress firewall.
  • Sweep endpoints for listed SHA256 hashes; if found, isolate the host and capture triage (memory, process tree, persistence locations, browser credential stores where legally permitted).
  • Hunt for SSH reverse tunnel behavior (ssh -R, autossh patterns) on developer workstations, especially macOS systems with IDE extensions installed.
  • If any users installed Cursor extension anthropic.claude-code versions 2.1.312/2.1.313 during the exposure window: treat as compromised, remove the extension, and rotate credentials present on the device.

24 hours

  • Because credential theft is central across these pulses, force password resets and session revocation for impacted users (SSO + email + VPN + cloud consoles).
  • Rotate developer and CI/CD secrets: GitLab personal access tokens, deploy keys, runner tokens, and any secrets stored in CI variables. Invalidate tokens observed in logs from unusual ASN/geography.
  • Audit GitLab (and related VCS/CI) for: new tokens, new runners, new deploy keys, permission changes, suspicious pipeline edits, and unusual export/download activity.
  • For Ukraine-targeted organizations: review mail gateways for spearphishing lure themes and validate patching/mitigation status for CVE-2025-8088.

1 week

  • Harden extension/supply-chain risk: restrict IDE extension installation to an allowlist, enable extension provenance verification where possible, and monitor for extension-driven child processes and persistence.
  • Reduce blast radius of CI/CD compromise: move secrets to a managed vault, enforce short-lived credentials, tighten runner isolation, and require approvals for pipeline variable changes.
  • Improve egress controls: alert on uncommon outbound SSH (especially long-lived tunnels) and require explicit allowlisting for developer remote access patterns.
  • Operationalize threat intel: create a repeatable pipeline to ingest OTX pulses into SIEM watchlists and EDR indicator sets, with TTLs and confidence scoring.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub

darkwebotx-pulsedarkweb-credentialsgorbaggiftedcrookclaude-code-extensionssh-backdoorgitlab-secrets

Is your security operations ready?

Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.

Book a SOC AssessmentSee AlertMonitor in Action