Back to Intelligence

Hermes AI-Driven Espionage, N4D go-titan & Supply Chain Credential Theft: OTX Pulse Detection Pack

SA
Security Arsenal Team
August 22, 2026
11 min read

Five concurrent OTX pulses converge on a single operational theme: industrialized credential and secret theft, increasingly automated and increasingly aimed at the software supply chain and webmail planes rather than endpoints alone.

The most strategically significant pulse is the Hermes autonomous AI agent operation against Thailand's Ministry of Finance. Recovered tooling from an exposed Hong Kong staging server shows a fully unattended attack pipeline: the AI agent selected and chained exploits (CVE-2017-7269 IIS/WebDAV, CVE-2021-3156 sudo Baron Samedit, CVE-2021-4034 PwnKit, plus multiple 2026-era HiveServer2 and Apache Hadoop flaws), staged the Go-based Hades implant, deployed VShell and ShadowPad (S0596) / POISONPLUG.SHADOW, and tunneled traffic with suo5. This is autonomous attack operations with zero human-in-the-loop pacing.

Parallel pulses show credential theft diversifying:

  • BRIDGEHEAD — 40 typosquatted npm packages (mimicking chalk, axios, commander, lodash, react, typescript) whose install scripts profile hosts, cross the WSL→Windows boundary, and run a 22MB Rust-based crypto-wallet and browser-credential stealer entirely in memory.
  • N4D Mesh Controller / go-titan — a Linux malware campaign exploiting exposed Model Context Protocol (MCP) servers and Ray dashboards (CVE-2023-48022) for credential theft and lateral movement, now on rotated infrastructure (209.99.186.235, cdnorigin.net) with a UPX-packed agent labeled 33.8-go-titan.
  • Void Blizzard / LAUNDRY BEAR (CL-STA-1114) — Russian-nexus zero-click phishing against Zimbra webmail (CVE-2025-66376) with JavaScript injection, targeting government, defense, transportation, and finance across NATO states, Ukraine, CIS, and Africa.
  • Rust crates supply chain attack — legitimate crates (arrayref, internment, append-only-vec) compromised via a proc-macro1 typosquat of proc-macro2, executing cross-platform malware at build time through build.rs, pulling staged payloads from 23.254.165.112:9089 — a direct path into CI/CD secrets and developer credentials.

Collectively: adversaries are harvesting credentials where they live at scale — developer build pipelines, browser stores, crypto wallets, and webmail sessions — while autonomous agents compress intrusion timelines from days to hours.

Threat Actor / Malware Profile

Hermes + Hades (Autonomous Espionage Stack)

  • Distribution: Exploit-driven initial access against internet-facing services (IIS 6.0 WebDAV, Hadoop/HiveServer2, sudo/Polkit on Linux). AI agent operates in unattended "YOLO" mode, autonomously selecting exploit chains.
  • Payload behavior: Hades is a custom Go implant staged post-exploitation; ShadowPad/POISONPLUG provides modular espionage capability; stolen credentials were recovered on the staging server.
  • C2: suo5 HTTP tunneling for proxied C2 through compromised web servers; VShell webshells for fallback access.
  • Persistence: Webshells on compromised web infrastructure; ShadowPad traditionally persists via DLL side-loading of legitimate signed binaries.
  • Anti-analysis: Tooling staged in exposed directories on offshore infrastructure (Hong Kong); modular implants; exploit code kept off-target until execution.

BRIDGEHEAD (Rust In-Memory Stealer)

  • Distribution: npm typosquatting with malicious install scripts (preinstall/postinstall) in packages mimicking top-tier libraries.
  • Payload behavior: Host profiling; on Windows/WSL detection, downloads a 22MB Rust executable from GitHub that runs fileless in memory, targeting crypto wallets and browser credential stores; exfiltration via Telegram.
  • Persistence: None on disk by design — reinfection relies on the poisoned package remaining in dependency trees.
  • Anti-analysis: In-memory-only execution, environment profiling (skips non-Windows/non-WSL), legitimate GitHub hosting to blend with normal traffic.

N4D Mesh Controller / go-titan

  • Distribution: Exploitation of exposed MCP servers, Ray dashboards (CVE-2023-48022), and other internet-facing Linux services (CVE-2026-26220, CVE-2026-27944, CVE-2026-33032, CVE-2026-39987).
  • Payload behavior: Loader-to-agent chain deploying UPX-packed 33.8-go-titan; credential harvesting, lateral movement, mesh-style C2 relay.
  • C2: Rotated infrastructure including 209.99.186.235 and cdnorigin.net.
  • Anti-analysis: UPX packing, loader/agent separation, infrastructure rotation between campaigns.

Void Blizzard (CL-STA-1114) Webmail Espionage

  • Distribution: Zero-click phishing against Zimbra, exploiting CVE-2025-66376; malicious JavaScript injected into the victim's webmail session on render — no user interaction required beyond viewing.
  • Payload behavior: Session hijacking, mailbox content theft, and credential capture via lookalike analytics domains (zimbra-metadata.com, zimbrastat.com, emailanalytics.com.ua, istc-cloud.com).
  • Persistence: JavaScript injection embedded in mailbox content; re-executes on each view.

proc-macro1 Build-Time Backdoor

  • Distribution: Compromise of legitimate maintainer crates; malicious proc-macro1 dependency injected into arrayref, internment, append-only-vec.
  • Payload behavior: build.rs executes automatically during cargo build, downloading staged payloads from 23.254.165.112:9089 (/rust-crate_0.1.0–_0.4.0); targets developer credentials and CI/CD secrets.
  • Anti-analysis: Executes only at build time (invisible at runtime), typosquat of a crate so ubiquitous it rarely draws scrutiny.

IOC Analysis

This pulse set spans five indicator classes, each requiring a different operationalization path:

  • CVEs (13 total): Prioritize CVE-2025-66376 (Zimbra — actively exploited, zero-click), CVE-2023-48022 (Ray dashboard), CVE-2021-3156 / CVE-2021-4034 (Linux privesc used by Hermes), and the Hadoop/HiveServer2 2026 CVEs. Feed into your vuln scanner as KEV-style priority tags, not standard SLA queues.
  • Domains (7): The Void Blizzard set (zimbra-metadata.com, zimbrastat.com, mailnalysis.com, analyticemailmeter.com, zimbrasoft.com.ua, emailanalytics.com.ua, istc-cloud.com) and N4D's cdnorigin.net. Push to DNS sinkhole/proxy block; hunt retroactively in DNS logs 90 days — note how convincingly these mimic legitimate analytics/Zimbra services.
  • IPs (2): 209.99.186.235 (N4D C2), 23.254.165.112:9089 (Rust payload staging). Block at egress; the non-standard port 9089 over HTTPS is itself a detection signal.
  • File hashes (SHA256/SHA1/MD5): Load into EDR blocklists; note BRIDGEHEAD payloads are in-memory, so hashes apply to the 22MB downloader stage captured in transit or GitHub artifacts, not disk artifacts.
  • URLs: The four rust-crate_0.x.0 staging URLs are versioned — expect _0.5.0+ rotation; alert on the URI pattern, not just exact matches.

Tooling: OTX pulses ingest directly into MISP/OpenCTI via the OTX DirectConnect API; Sigma rules below convert via sigmac or pySigma to Splunk/Sentinel/Elastic; hashes pivot in VirusTotal/OTX for related samples.

Detection Engineering

YAML
---
title: BRIDGEHEAD npm Typosquat - WSL to Windows In-Memory Payload Execution
id: 8f3a2b71-9c4e-4d5a-b6f1-2e8a7c1d9401
status: experimental
description: Detects npm install scripts spawning WSL/bash to download and execute payloads in-memory, crossing the WSL-Windows boundary as seen in the BRIDGEHEAD campaign
author: Security Arsenal Threat Intel
date: 2026/08/22
references:
    - https://www.cloudsek.com/blog/bridgehead-npm-typosquatting-wsl-windows-crypto-wallet-stealer
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\node.exe'
            - '\npm.cmd'
            - '\npm.exe'
            - '\wsl.exe'
            - '\bash.exe'
    selection_child:
        Image|endswith:
            - '\wsl.exe'
            - '\bash.exe'
            - '\curl.exe'
            - '\powershell.exe'
            - '\cmd.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Legitimate npm postinstall build scripts
level: high
tags:
    - attack.initial_access
    - attack.t1195.002
    - attack.t1059
---
title: Void Blizzard Zimbra Espionage - C2 and Impersonation Domain Resolution
id: 4d7e1c92-6b3f-4a8d-9e2c-1f5b8a3d6702
status: experimental
description: Detects DNS resolution of Void Blizzard / LAUNDRY BEAR (CL-STA-1114) Zimbra impersonation and exfiltration domains used in zero-click webmail espionage
author: Security Arsenal Threat Intel
date: 2026/08/22
references:
    - https://unit42.paloaltonetworks.com/russian-webmail-espionage/
logsource:
    category: dns
detection:
    selection:
        query:
            - 'zimbra-metadata.com'
            - 'zimbrastat.com'
            - 'zimbrasoft.com.ua'
            - 'emailanalytics.com.ua'
            - 'mailnalysis.com'
            - 'analyticemailmeter.com'
            - 'istc-cloud.com'
            - 'cdnorigin.net'
    condition: selection
falsepositives:
    - Threat research and sandbox detonation
level: critical
tags:
    - attack.command_and_control
    - attack.t1071.001
    - attack.t1566
---
title: Rust Build-Time Supply Chain Backdoor - Cargo Spawning Network Download
id: 2b9f4e83-7d1a-4c6b-8f3e-5a2c9d4b1803
status: experimental
description: Detects cargo/rustc build processes spawning network download tools or connecting to the proc-macro1 payload staging server during build-time execution via build.rs
author: Security Arsenal Threat Intel
date: 2026/08/22
references:
    - https://socket.dev/blog/popular-rust-crates-compromised
logsource:
    category: process_creation
    product: linux
detection:
    selection_parent:
        ParentImage|endswith:
            - '/cargo'
            - '/rustc'
    selection_child:
        Image|endswith:
            - '/curl'
            - '/wget'
            - '/python'
            - '/python3'
            - '/sh'
            - '/bash'
    selection_cmdline:
        CommandLine|contains:
            - '23.254.165.112'
            - ':9089'
            - 'rust-crate_0.'
    condition: (selection_parent and selection_child) or selection_cmdline
falsepositives:
    - Legitimate build scripts fetching precompiled binaries
level: high
tags:
    - attack.initial_access
    - attack.t1195.001
    - attack.t1105
KQL — Microsoft Sentinel / Defender
// Security Arsenal - OTX Pulse Hunt: Supply Chain C2, Webmail Espionage & Build-Time Backdoors
let SuspiciousDomains = dynamic(["zimbra-metadata.com","zimbrastat.com","zimbrasoft.com.ua","emailanalytics.com.ua","mailnalysis.com","analyticemailmeter.com","istc-cloud.com","cdnorigin.net"]);
let SuspiciousIPs = dynamic(["209.99.186.235","23.254.165.112"]);
let NetworkHits = DeviceNetworkEvents
| where Timestamp > ago(14d)
| where RemoteUrl in~ (SuspiciousDomains) or RemoteIP in (SuspiciousIPs)
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemotePort, RemoteUrl, ActionType
| extend HuntTag = "C2-Domain/IP Hit";
let BuildTimeAbuse = DeviceProcessEvents
| where Timestamp > ago(14d)
| where (InitiatingProcessFileName in~ ("cargo","rustc","node.exe","npm.cmd","npm"))
| where FileName in~ ("curl","wget","bash","sh","powershell.exe","wsl.exe","curl.exe")
   or ProcessCommandLine has_any ("rust-crate_0.",":9089","23.254.165.112")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, SHA256
| extend HuntTag = "Build/Install-Time Execution";
let WSLBridge = DeviceProcessEvents
| where Timestamp > ago(14d)
| where InitiatingProcessFileName =~ "wsl.exe" or FileName =~ "wsl.exe"
| where ProcessCommandLine has_any ("curl","wget","powershell",".exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| extend HuntTag = "WSL-Windows Boundary Crossing";
union NetworkHits, BuildTimeAbuse, WSLBridge
| sort by Timestamp desc
PowerShell
# Security Arsenal IOC Hunt - OTX Pulses 2026-08-22
# Hunts: BRIDGEHEAD npm artifacts, Rust build backdoor, N4D go-titan, Zimbra espionage DNS
Write-Host "[+] Security Arsenal Multi-Campaign IOC Hunt" -ForegroundColor Cyan

# --- 1. DNS cache check: Void Blizzard / N4D domains ---
$badDomains = @("zimbra-metadata.com","zimbrastat.com","zimbrasoft.com.ua","emailanalytics.com.ua","mailnalysis.com","analyticemailmeter.com","istc-cloud.com","cdnorigin.net")
Write-Host "[*] Checking DNS client cache for espionage/C2 domains..."
$dns = Get-DnsClientCache -ErrorAction SilentlyContinue
foreach ($d in $badDomains) {
    $hit = $dns | Where-Object { $_.Entry -like "*$d*" }
    if ($hit) { Write-Host "[!] DNS HIT: $d resolved on this host" -ForegroundColor Red; $hit | Format-Table Entry, Data }
}

# --- 2. Active/historical connections to C2 & staging IPs ---
Write-Host "[*] Checking network connections to 209.99.186.235 / 23.254.165.112 (port 9089)..."
$conns = Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object { $_.RemoteAddress -in @("209.99.186.235","23.254.165.112") -or $_.RemotePort -eq 9089 }
if ($conns) { Write-Host "[!] Suspicious connection found!" -ForegroundColor Red; $conns | Format-Table LocalPort, RemoteAddress, RemotePort, State, OwningProcess }

# --- 3. BRIDGEHEAD: typosquatted npm packages in global/local cache ---
Write-Host "[*] Scanning npm caches for recently added typosquat packages..."
$npmPaths = @("$env:APPDATA\npm-cache","$env:LOCALAPPDATA\npm-cache","$env:USERPROFILE\node_modules","$env:APPDATA\npm\node_modules")
$targets = @("chalk","axios","commander","lodash","react","typescript")
foreach ($p in $npmPaths) {
    if (Test-Path $p) {
        Get-ChildItem $p -Recurse -Directory -ErrorAction SilentlyContinue | Where-Object {
            $n = $_.Name.ToLower(); ($targets | Where-Object { $n -like "*$_*" -and $n -ne $_ }) -and $_.CreationTime -gt (Get-Date).AddDays(-30)
        } | ForEach-Object { Write-Host "[!] Suspicious npm package: $($_.FullName) (created $($_.CreationTime))" -ForegroundColor Yellow }
    }
}

# --- 4. Cargo build backdoor: malicious crates in Rust registry ---
Write-Host "[*] Checking Cargo registry for proc-macro1 typosquat..."
$cargoReg = "$env:USERPROFILE\.cargo\registry\src"
if (Test-Path $cargoReg) {
    Get-ChildItem $cargoReg -Recurse -Directory -ErrorAction SilentlyContinue | Where-Object { $_.Name -match "proc-macro1|proc-macro-en" } | ForEach-Object { Write-Host "[!] MALICIOUS CRATE: $($_.FullName)" -ForegroundColor Red }
}

# --- 5. WSL boundary abuse: WSL processes with Windows payload execution ---
Write-Host "[*] Checking for WSL processes with suspicious command history..."
$wslProcs = Get-CimInstance Win32_Process -Filter "Name='wsl.exe' OR Name='bash.exe'" -ErrorAction SilentlyContinue
foreach ($proc in $wslProcs) {
    if ($proc.CommandLine -match "curl|wget|powershell|\.exe") {
        Write-Host "[!] WSL suspicious: PID $($proc.ProcessId) :: $($proc.CommandLine)" -ForegroundColor Yellow
    }
}

# --- 6. Persistence check: Run keys & scheduled tasks created in last 14 days ---
Write-Host "[*] Checking persistence mechanisms (last 14 days)..."
Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run","HKLM:\Software\Microsoft\Windows\CurrentVersion\Run" -ErrorAction SilentlyContinue | Format-List
Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object { $_.Date -and ([datetime]$_.Date) -gt (Get-Date).AddDays(-14) } | Select-Object TaskName, TaskPath, Date | Format-Table
Write-Host "[+] Hunt complete. Escalate any Red findings to IR immediately." -ForegroundColor Cyan

Response Priorities

Immediate (0–4 hours)

  • Block all Void Blizzard domains, cdnorigin.net, 209.99.186.235, and 23.254.165.112:9089 at DNS, proxy, and egress firewall; alert on HTTPS-to-non-standard-port patterns.
  • Hunt retroactively (90 days) in DNS and proxy logs for the Zimbra impersonation domains — resolution from a mail server or user workstation indicates likely session compromise.
  • Freeze dependency installs: pin and audit npm/Cargo lockfiles; search for the 40 BRIDGEHEAD typosquats and proc-macro1/proc-macro-en across all repos and CI runners.
  • Isolate any host where the KQL hunt returns Build/Install-Time Execution hits.

24 Hours

  • Force credential rotation for any user whose mailbox or endpoint shows Zimbra-domain DNS hits — assume session tokens and passwords are stolen (zero-click = no phish-resistant guarantee).
  • Rotate developer secrets: API keys, tokens, and signing keys present on any machine that built with a compromised crate or installed a typosquatted npm package; audit CI/CD secret stores for anomalous access.
  • Reset crypto-wallet exposure: any developer with wallet extensions on a BRIDGEHEAD-hit machine should treat wallets as drained and migrate assets.
  • Patch Zimbra (CVE-2025-66376) and Ray dashboards (CVE-2023-48022) immediately; verify sudo/Polkit patch levels on Linux estate against the Hermes exploit set.

1 Week

  • Remove MCP servers and Ray dashboards from internet exposure or place behind authenticated gateways — these are now active scanning targets for N4D.
  • Deploy private registry proxies (npm/crates) with allowlisting and typosquat detection; enforce Sigstore/cosign-style provenance verification in build pipelines.
  • Disable or sandbox build.rs/postinstall execution in CI where feasible (e.g., --ignore-scripts, isolated build containers with egress deny-by-default).
  • Segment WSL from Windows credential stores; apply WSL policy controls and monitor cross-boundary process chains as a standing detection.
  • Brief leadership on autonomous-agent threats: the Hermes operation demonstrates AI-driven exploitation compressing attacker dwell time — detection SLAs measured in hours are no longer sufficient for internet-facing finance and government infrastructure.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub

darkwebotx-pulsedarkweb-credentialscredential-theftsupply-chain-attacktyposquattingwebmail-espionagelinux-malware

Is your security operations ready?

Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.

Book a SOC AssessmentSee AlertMonitor in Action