Gremlin Stealer, SD-WAN Exploits & NPM Supply Chain Attacks: Credential Theft Campaigns — OTX Pulse Analysis

title: Potential Gremlin Stealer VM-Based Packed Payload
id: 89c92f1b-4b8e-4f3a-8b6d-3e4b6f5a8c9d
description: Detects suspicious child processes often spawned by heavily packed malware like Gremlin Stealer using instruction virtualization.
status: experimental
date: 2026/05/15
author: Security Arsenal
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\mshta.exe'
      - '\wscript.exe'
    Image|endswith:
      - '\rundll32.exe'
      - '\regsvr32.exe'
    CommandLine|contains:
      - ' -i '
      - ' EntryPoint '
      - ' #1 '
  condition: selection
falsepositives:
  - Legitimate software installers
level: high
tags:
  - attack.defense_evasion
  - attack.execution
  - attack.t1204

---

title: NPM Supply Chain Attack - OtterCookie Pattern
id: a7b3c9d2-4e1f-3a5b-8c6d-7e8f9a0b1c2d
description: Detects Node.js spawning a shell, a common behavior in malicious npm packages like OtterCookie to execute payloads.
status: experimental
date: 2026/05/15
author: Security Arsenal
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\node.exe'
      - '\npm.cmd'
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\wscript.exe'
  condition: selection
falsepositives:
  - Legitimate build scripts
level: high
tags:
  - attack.initial_access
  - attack.supply_chain
  - attack.t1195

---

title: Cisco SD-WAN Exploitation Activity - UAT-8616
id: b1c2d3e4-5f6a-7b8c-9d0e-1f2a3b4c5d6e
description: Detects potential webshell upload activity or exploitation of Cisco SD-WAN vulnerabilities associated with UAT-8616.
status: experimental
date: 2026/05/15
author: Security Arsenal
logsource:
  category: web
  product: apache
  # or nginx/iis depending on deployment
detection:
  selection_uri:
    Uri|contains:
      - '/vpnportal/'
      - '/uploads/'
  selection_keywords:
    Uri|contains:
      - 'shell.php'
      - '.aspx?'
      - 'eval('
  condition: all of selection_*
falsepositives:
  - Administrative management activity
level: critical
tags:
  - attack.initial_access
  - attack.exploitation
  - attack.t1190

// Hunt for Gremlin and Vidar Stealer File Hashes
DeviceProcessEvents
| where SHA256 in (
    '1bd0a200528c82c6488b4f48dd6dbc818d48782a2e25ccd22781c5718c3f62f5', 
    '971198ff86aeb42739ba9381923d0bc6f847a91553ec57ea6bae5becf80f8759', 
    '06f63fe3eba5a2d1e2177d49f25721c2bdd90f3c46f19e29740899fa908453bf'
)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, AccountName;

// Hunt for Network Connections to known C2 IPs
DeviceNetworkEvents
| where RemoteIP in ('194.87.92.109', '176.65.139.31', '94.228.161.88')
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName;

// Hunt for CVE-2026-20182 Exploitation Attempts
DeviceProcessEvents
| where ProcessCommandLine has 'CVE-2026-20182' or ProcessCommandLine has 'CVE-2026-20133'
| project Timestamp, DeviceName, ProcessCommandLine, AccountName;

# IOC Hunt Script for Gremlin, OtterCookie, and Gentlemen Campaigns
# Requires Administrator Privileges

$HashList = @(
    "1bd0a200528c82c6488b4f48dd6dbc818d48782a2e25ccd22781c5718c3f62f5",
    "2172dae9a5a695e00e0e4609e7db0207d8566d225f7e815fada246ae995c0f9b",
    "d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa",
    "3ab9575225e00a83a4ac2b534da5a710bdcf6eb72884944c437b5fbe5c5c9235",
    "06f63fe3eba5a2d1e2177d49f25721c2bdd90f3c46f19e29740899fa908453bf",
    "51b9f246d6da85631131fcd1fabf0a67937d4bdde33625a44f7ee6a3a7baebd2"
)

$PathsToScan = @("C:\Users\", "C:\ProgramData\", "C:\Windows\Temp")

Write-Host "[+] Starting IOC Scan..." -ForegroundColor Cyan

# Scan for Malicious Files
foreach ($Path in $PathsToScan) {
    if (Test-Path $Path) {
        Write-Host "[+] Scanning $Path..." -ForegroundColor Yellow
        Get-ChildItem -Path $Path -Recurse -ErrorAction SilentlyContinue | Get-FileHash -Algorithm SHA256 -ErrorAction SilentlyContinue | Where-Object { 
            $HashList -contains $_.Hash 
        } | ForEach-Object {
            Write-Host "[!] ALERT: Malicious file found: $($_.Path) (SHA256: $($_.Hash))" -ForegroundColor Red
        }
    }
}

# Check for Suspicious NPM Activity (OtterCookie Check)
Write-Host "[+] Checking NPM Cache for suspicious packages..." -ForegroundColor Yellow
$NpmCache = "$env:APPDATA\npm-cache"
if (Test-Path $NpmCache) {
    # Check for recently created packages in the last 7 days
    $DateCutoff = (Get-Date).AddDays(-7)
    Get-ChildItem -Path $NpmCache -Recurse -Filter "package." | Where-Object { $_.LastWriteTime -gt $DateCutoff } | ForEach-Object {
        Write-Host "[?] Suspicious recent NPM package: $($_.FullName)" -ForegroundColor DarkYellow
    }
}

Write-Host "[+] Scan Complete." -ForegroundColor Cyan