Threat Summary
The latest OTX pulses highlight a convergence of high-impact threats targeting diverse sectors. First, the Hirudo Android banking trojan is actively targeting financial institutions across Asia, the Americas, and North Africa. Distributed via fake update prompts in shopping and entertainment apps, Hirudo replaces legitimate banking applications with patched versions that disable internal security checks, enabling credential theft and full device takeover.
Second, the BlackNevas ransomware campaign demonstrates a sophisticated approach to virtualized infrastructure destruction. Rather than relying solely on vulnerabilities, the adversary compromised VMware vCenter and ESXi hosts using legitimate management interfaces, systematically destroying virtual machines and backup infrastructure over a ten-day period. This campaign involves multiple ransomware families including Babuk, LockBit, and Hive derivatives.
Third, the Cyber Av3ngers (linked to IRGC) conducted cyber sabotage against commercial refrigeration systems across 12 European countries. Exploiting internet-exposed OT devices with default credentials and unpatched vulnerabilities, the attackers manipulated refrigeration controls in retail and healthcare environments, causing operational disruption and potential safety hazards.
Collectively, these campaigns underscore a shift toward credential theft, infrastructure destruction, and OT sabotage, with adversaries increasingly blending commodity malware with advanced intrusion techniques.
Threat Actor / Malware Profile
Hirudo (Android Banking RAT)
- Distribution: Droppers disguised as shopping/entertainment apps on third-party stores; fake update prompts.
- Payload Behavior: Replaces legitimate banking apps with patched versions that bypass security checks; steals credentials and enables remote control (RAT functionality).
- C2 Communication: Likely uses HTTP/S or WebSocket channels for command execution and data exfiltration.
- Persistence: Installs as a separate package; may abuse accessibility services or device admin privileges.
- Anti-Analysis: Patched app versions may include anti-tampering and obfuscation techniques.
BlackNevas (ESXi Ransomware)
- Distribution: Initial access via compromised credentials or exposed management interfaces (vCenter/ESXi).
- Payload Behavior: Encrypts virtual machines and destroys backups; leverages tools like MeshAgent and Ligolo-ng for lateral movement and tunneling.
- C2 Communication: Uses legitimate VMware APIs and potentially Tor or custom C2 for command execution.
- Persistence: Modifies ESXi configurations and deploys ransomware binaries directly on hypervisors.
- Anti-Analysis: Uses legitimate management tools to blend in; may disable logging or delete shadow copies.
Cyber Av3ngers (OT Sabotage)
- Distribution: Exploits internet-exposed OT devices with default credentials or known vulnerabilities (e.g., CVE-2021-38459, CVE-2023-45208).
- Payload Behavior: Manipulates refrigeration system controls (temperature, alarms); causes physical disruption.
- C2 Communication: Direct access via exposed IPs; may use custom protocols or web interfaces.
- Persistence: Changes configurations or installs backdoors on OT devices.
- Anti-Analysis: Operates in low-and-slow manner to avoid detection; targets legacy systems with limited monitoring.
IOC Analysis
The indicators provided span multiple types:
- CVEs: Critical for vulnerability management teams to prioritize patching (e.g., CVE-2021-22005 for vCenter, CVE-2024-40711 for ESXi, CVE-2021-38459 for OT devices).
- IPv4 Addresses: Block or monitor for C2 and scanning activity. Examples:
188.240.57.94(UK-based hosting),91.92.242.121(Bulgaria),188.208.141.210(OT target). - File Hashes (MD5/SHA1/SHA256): Deploy in EDR, firewall, and email gateway blocking. Use sandboxing (e.g., Any.Run, Hybrid Analysis) to detonate and extract additional IOCs.
- URLs/Domains: Not explicitly listed, but references suggest C2 infrastructure; monitor for connections to suspicious domains.
Operationalization:
- Ingest IOCs into SIEM (e.g., Splunk, Sentinel) and threat intelligence platforms (e.g., MISP, ThreatConnect).
- Use tools like
sigmaandvelociraptorfor detection and hunting. - Cross-reference hashes with VirusTotal and AlienVault OTX for reputation scoring.
Detection Engineering
YAML
---
title: Hirudo Android Banking Trojan - Fake Update Dropper
id: 8f2e4b1c-3d4a-4e5f-9a6b-7c8d9e0f1a2b
status: experimental
description: Detects installation of Hirudo banking trojan via fake update prompts in shopping/entertainment apps
author: Security Arsenal
date: 2026/11/13
references:
- https://www.threatfabric.com/blogs/hirudo-from-fake-updates-to-patched-banking-apps
logsource:
category: process_creation
product: android
detection:
selection:
Image|contains:
- 'com.android.vending'
- 'com.google.android.packageinstaller'
CommandLine|contains:
- 'install'
- 'update'
ParentImage|contains:
- 'com.android.browser'
- 'com.android.chrome'
condition: selection
falsepositives:
- Legitimate app updates from official stores
level: high
tags:
- attack.t1059
- attack.t1059.001
- attack.t1027
---
title: ESXi Ransomware - Backup Destruction via vCenter
id: 9a1b2c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects unauthorized access to vCenter and deletion of VM backups by BlackNevas ransomware
description: Detects unauthorized access to vCenter and deletion of VM backups by BlackNevas ransomware
author: Security Arsenal
date: 2026/11/13
references:
- https://securelist.com/esxi-ransomware/121959/
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith:
- '\vicfg-user.exe'
- '\vim-cmd.exe'
CommandLine|contains:
- 'vmsvc/destroy'
- 'snapshot.remove'
- 'backup.delete'
condition: selection
falsepositives:
- Legitimate admin scripts
level: critical
tags:
- attack.t1490
- attack.t1078
- attack.t1021
---
title: Cyber Av3ngers OT Sabotage - Default Credential Access
id: 0a1b2c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects login attempts to OT devices using default credentials associated with Cyber Av3ngers
author: Security Arsenal
date: 2026/11/13
references:
- https://dti.domaintools.com/research/european-refrigeration-systems-cyber-sabotage
logsource:
category: authentication
product: firewall
detection:
selection:
dst_ip:
- '188.208.141.210'
user|contains:
- 'admin'
- 'root'
- 'support'
password|contains:
- 'admin'
- 'password'
- '12345'
condition: selection
falsepositives:
- Internal scanning
level: high
tags:
- attack.t1078
- attack.t1133
- attack.t0812
KQL — Microsoft Sentinel / Defender
// Hunt for Hirudo C2 and ESXi ransomware activity in Microsoft Sentinel
let HirudoHashes = dynamic([
"0097a0406be20544e98e981075427f40789db40fe4a53b1b4523383a945328b7",
"2e45277acfde3fb704179476b08f428f66a03670bbdbf2e8ec79c0b0333c009b",
"425cd7072b5e9386ac94e97fe272980b6ef36240df6b5d77b371ab7378004c83",
"b2270c29b3d0a49a716730d6ef108cffec0b1a4b159dd02e93333fb85e492b99",
"d51f2bd7ffb49c224d8eaec2c8ca1c8ab9fce2fd5fdceea01eb54296c2f47b4d",
"f796eb9ecf516e4f1fafcf89200d9f7d8ddd234f705e63f1bc8fc3ef583f0248"
]);
let SuspiciousIPs = dynamic(["188.240.57.94", "91.92.242.121", "188.208.141.210"]);
union isfuzzy=true
(DeviceNetworkEvents
| where RemoteIP in (SuspiciousIPs)
| project TimeGenerated, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, InitiatingProcessCommandLine),
(DeviceProcessEvents
| where SHA256 in (HirudoHashes) or FileName has_any ("vicfg-user.exe", "vim-cmd.exe")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, SHA256),
(SecurityEvent
| where EventID == 4625
| where IpAddress in (SuspiciousIPs)
| project TimeGenerated, Computer, IpAddress, TargetUserName, LogonType)
| order by TimeGenerated desc
PowerShell
# PowerShell IOC Hunt Script for BlackNevas and Cyber Av3ngers Indicators
$iocIPs = @("188.240.57.94", "91.92.242.121", "188.208.141.210")
$iocHashes = @(
"0097a0406be20544e98e981075427f40789db40fe4a53b1b4523383a945328b7",
"2e45277acfde3fb704179476b08f428f66a03670bbdbf2e8ec79c0b0333c009b",
"425cd7072b5e9386ac94e97fe272980b6ef36240df6b5d77b371ab7378004c83"
)
Write-Host "[+] Checking for network connections to suspicious IPs..." -ForegroundColor Green
Get-NetTCPConnection | Where-Object { $_.RemoteAddress -in $iocIPs } | Format-Table -AutoSize
Write-Host "[+] Checking for suspicious processes (vCenter tools, ransomware)..." -ForegroundColor Green
Get-Process | Where-Object { $_.ProcessName -match "vicfg-user|vim-cmd|meshagent|ligolo" } | Format-Table -AutoSize
Write-Host "[+] Checking for file hashes in common directories..." -ForegroundColor Green
$paths = @("C:\Users\*\Downloads", "C:\Temp", "C:\ProgramData")
foreach ($path in $paths) {
Get-ChildItem -Path $path -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
$hash = Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue
if ($hash.Hash -in $iocHashes) {
Write-Host "[!] Found malicious file: $($_.FullName)" -ForegroundColor Red
}
}
}
Write-Host "[+] Checking for persistence via scheduled tasks..." -ForegroundColor Green
Get-ScheduledTask | Where-Object { $_.TaskName -match "update|backup|vmware" } | Format-Table -AutoSize
Write-Host "[+] Hunt complete. Review findings above." -ForegroundColor Green
Response Priorities
Immediate (0-24 hours):
- Block all listed IPv4 addresses and file hashes at perimeter and endpoint.
- Hunt for execution artifacts (processes, network connections) using the provided KQL and PowerShell scripts.
- Isolate any ESXi hosts or OT devices showing signs of compromise.
24-48 hours:
- If credential theft (Hirudo) is suspected, force password resets for affected users and enable MFA.
- Review vCenter and ESXi logs for unauthorized access or backup deletion.
- Scan OT networks for default credentials and unpatched vulnerabilities.
1 week:
- Implement network segmentation between IT and OT environments.
- Harden VMware infrastructure: disable unnecessary services, enforce strong authentication, and patch known CVEs.
- Deploy application whitelisting on critical systems and mobile devices.
- Conduct tabletop exercises for ransomware and OT sabotage scenarios.
Related Resources
Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.