Recent OTX pulse data reveals a convergence of state-sponsored espionage, financially motivated cybercrime, and opportunistic infrastructure exploitation. The Hydra Saiga threat actor continues its campaign against critical infrastructure and government entities across Central Asia and Europe, utilizing the JLORAT and Telemiris malware families with a distinct reliance on Telegram Bot APIs for Command and Control (C2). Simultaneously, a JanaWare ransomware campaign is leveraging the polymorphic Adwind RAT to specifically target Turkish entities through geofenced phishing payloads. Separately, a critical vulnerability in the Langflow AI framework (CVE-2026-33017) has seen mass exploitation within hours of disclosure, using OAST (Out-of-Band Application Security Testing) services to identify vulnerable exposed pipelines.

Collectively, these pulses highlight a threat landscape where adversaries are increasingly abusing legitimate communication platforms (Telegram), repurposing commodity Java malware for niche geofenced attacks, and rapidly exploiting vulnerabilities in emerging AI infrastructure.

Threat Actor / Malware Profile

Hydra Saiga

Objective: Espionage and data exfiltration from critical utilities (Energy, Water, Government) and legal sectors.
Malware Families: JLORAT (Custom implant), Telemiris.
Distribution Method: Initial access vectors are not fully detailed in the pulse but typically involve spear-phishing or supply chain compromises given the target profile.
C2 Communication: Abuses Telegram Bot API. This allows the adversary to blend in with legitimate traffic, bypassing traditional network egress controls that often allow Telegram access.
Persistence Mechanisms: Likely utilizes "Living off the Land" (LotL) binaries and scheduled tasks, consistent with their described profile.
Anti-Analysis: Uses custom implants to evade signature-based detection.

JanaWare / Adwind RAT

Objective: Financial gain via ransomware delivery against Turkish users and SMBs.
Malware Families: Adwind (Java RAT), JanaWare (Ransomware).
Distribution Method: Phishing campaigns containing polymorphic Java attachments.
Payload Behavior: The Adwind RAT checks the system locale and external IP geolocation (Geofencing) to ensure the target is in Turkey before deploying the JanaWare ransomware payload.
C2 Communication: Utilizes dynamic DNS providers (e.g., DuckDNS) to host C2 infrastructure, facilitating rapid infrastructure changes.

CVE-2026-33017 (Langflow)

Objective: Remote Code Execution (RCE) and data theft from AI workflows.
Vulnerability: Unauthenticated RCE in Langflow (visual framework for AI agents).
Attack Vector: Scanners and automated exploit tools query exposed Langflow instances and execute code. The attack chain involves interacting with specific API endpoints to inject malicious commands.
Detection: Exploitation is immediately signaled by outbound connections to OAST domains (e.g., oast.live, oast.pro), indicating data exfiltration or verification of vulnerability.

IOC Analysis

The provided indicators represent three distinct operational footprints:

State-Sponsored C2 Infrastructure (Hydra Saiga): A list of domains and hostnames (e.g., allcloudindex.com, docworldme.com) likely resolving to C2 servers. These should be blocked immediately at the perimeter and DNS layer.
Criminal Infrastructure (Adwind/JanaWare): MD5 file hashes for the polymorphic Java payloads and specific DuckDNS hostnames (e.g., elementsplugin.duckdns.org). The use of non-standard ports (:49152, :49153) is a key behavioral indicator.
Exploitation Artifacts (Langflow): Interactsh/OAST hostnames. These are not "malware" in the traditional sense but are proof-of-exploitation artifacts. Connections to these domains from internal servers indicate successful RCE.

Operational Guidance: SOC teams should load the domains and hostnames into firewall blocklists and SIEM correlation searches. The file hashes should be used to scan historical EDR data for dormant infections. The OAST domains should be used in DNS logs to hunt for broader exploitation attempts beyond Langflow.

Detection Engineering

Sigma Rules

YAML

title: Potential Telegram Bot API C2 Traffic
id: 4f6c8a9a-1b2c-3d4e-5f6g-7h8i9j0k1l2m
description: Detects suspicious connections to Telegram Bot API which may be used as C2 by malware like JLORAT.
status: experimental
date: 2026/04/20
author: Security Arsenal
logsource:
    category: network_connection
detection:
    selection:
        DestinationHostname|endswith:
            - 'api.telegram.org'
    filter_legit:
        Image|endswith:
            - '\telegram.exe'
            - '\chrome.exe'
            - '\firefox.exe'
            - '\msedge.exe'
    condition: selection and not filter_legit
falsepositives:
    - Legitimate use of Telegram API by internal authorized tools
level: high
tags:
    - c2
    - telegram
    - attack.command_and_control
---
title: Java Spawning Shell (Adwind RAT Behavior)
id: a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d
description: Detects Java process spawning cmd or PowerShell, typical of Java RATs like Adwind/jRAT.
status: experimental
date: 2026/04/20
author: Security Arsenal
logsource:
    category: process_creation
detection:
    selection_parent:
        ParentImage|endswith:
            - '\java.exe'
            - '\javaw.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Legitimate Java applications executing system commands
level: high
tags:
    - malware
    - adwind
    - attack.execution
---
title: Outbound Connection to OAST Domain
id: b2c3d4e5-f6a7-4b5c-9d0e-1f2a3b4c5d6e
description: Detects outbound connections to known OAST (Out-of-Band Application Security Testing) domains, indicating potential RCE exploitation or data exfiltration.
status: experimental
date: 2026/04/20
author: Security Arsenal
logsource:
    category: dns_query
detection:
    selection:
        QueryName|contains:
            - '.oast.live'
            - '.oast.me'
            - '.oast.pro'
            - '.oast.fun'
            - '.oast.site'
            - '.burpcollaborator.net'
    condition: selection
falsepositives:
    - Authorized penetration testing activities
level: critical
tags:
    - exploitation
    - c2
    - attack.exfiltration

KQL (Microsoft Sentinel)

KQL — Microsoft Sentinel / Defender

// Hunt for Hydra Saiga C2 Domains and Adwind RAT indicators
let IoCDomains = dynamic(['allcloudindex.com', 'docworldme.com', 'pweobmxdlboi.com', 'wincorpupdates.com', 'adm-govuz.com', 'inboxsession.info', 'elementsplugin.duckdns.org']);
let IoCHashes = dynamic(['4f0444e11633a331eddb0deeec17fd69', 'b2d5bbf7746c2cb87d5505ced8d6c4c6']);
// Network Connections to IOC Domains
DeviceNetworkEvents
| where RemoteUrl in (IoCDomains) or RemoteUrl has_any (IoCDomains)
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemotePort, Action
| union (
    // File Hash Matches
    DeviceFileEvents
    | where SHA256 in (IoCHashes) or MD5 in (IoCHashes) // Note: MD5 is not always available, adjust hash type based on schema availability, pulse provided MD5
    | project Timestamp, DeviceName, FileName, FolderPath, SHA256, MD5
)
| union (
    // DNS Queries for OAST domains (Langflow Exploitation)
    DeviceNetworkEvents
    | where RemoteUrl contains ".oast."
    | project Timestamp, DeviceName, RemoteUrl, InitiatingProcessFileName
)

PowerShell

# IOC Hunt Script for Hydra Saiga and JanaWare/Adwind
# Requires Administrative privileges for comprehensive checks

# Define IOCs
$MaliciousDomains = @(
    "allcloudindex.com", "docworldme.com", "pweobmxdlboi.com", 
    "wincorpupdates.com", "adm-govuz.com", "elementsplugin.duckdns.org"
)
$MaliciousHashes = @(
    "4f0444e11633a331eddb0deeec17fd69", 
    "b2d5bbf7746c2cb87d5505ced8d6c4c6"
)

Write-Host "[*] Checking DNS Cache for malicious domains..." -ForegroundColor Cyan
$DnsCache = Get-DnsClientCache | Where-Object { $MaliciousDomains -contains $_.Entry }
if ($DnsCache) {
    Write-Host "[!] Suspicious DNS entries found:" -ForegroundColor Red
    $DnsCache | Format-Table Entry, Data, Type
} else {
    Write-Host "[-] No suspicious DNS entries found." -ForegroundColor Green
}

Write-Host "[*] Scanning for processes with module loads matching potential Java RATs..." -ForegroundColor Cyan
$JavaProcesses = Get-Process -Name java -ErrorAction SilentlyContinue
if ($JavaProcesses) {
    foreach ($proc in $JavaProcesses) {
        # Check for suspicious child processes (simplified)
        Write-Host "[+] Found Java Process PID: $($proc.Id) - Path: $($proc.Path)"
    }
}

Write-Host "[*] Checking hosts file for domain redirects..." -ForegroundColor Cyan
$HostsPath = "$env:SystemRoot\System32\drivers\etc\hosts"
if (Test-Path $HostsPath) {
    Select-String -Path $HostsPath -Pattern ($MaliciousDomains -join '|')
}

Write-Host "[*] Scanning specific user directories for JAR files (Heuristic)..." -ForegroundColor Cyan
# Note: This is a noisy check and intended for hunting in user profiles
$PathsToScan = @("$env:USERPROFILE\Downloads", "$env:USERPROFILE\Desktop")
foreach ($path in $PathsToScan) {
    if (Test-Path $path) {
        Get-ChildItem -Path $path -Filter *.jar -Recurse -ErrorAction SilentlyContinue | Select-Object FullName, CreationTime, LastWriteTime
    }
}


# Response Priorities

*   **Immediate:**
    *   Block all listed domains and hostnames at the DNS layer and firewall.
    *   Identify and isolate any systems communicating with OAST domains (`*.oast.*`) as this indicates active exploitation (RCE).
    *   Patch Langflow instances to the latest secure version immediately or restrict network access to `/api` endpoints.

*   **24h:**
    *   Conduct a forensic review of systems that resolved the Hydra Saiga C2 domains to assess data exfiltration scope.
    *   Review Java execution policies and alert on unsigned JAR files or Java spawning shells.
    *   If credential theft is suspected (common with RATs like Adwind), force password resets for privileged accounts on affected segments.

*   **1 week:**
    *   Implement egress filtering to block Telegram Bot API from non-workstation assets if not required for business operations, given its use by JLORAT.
    *   Review and harden AI/ML pipeline security, ensuring all Langflow or similar tools are not exposed to the public internet without authentication.
    *   Update phishing awareness training specifically highlighting geofenced malware delivery mechanisms.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub

Hydra Saiga JLORAT Espionage, JanaWare Ransomware, and Langflow AI Exploitation: OTX Pulse Analysis