Infostealer Surge: TeamPCP Supply Chain, LofyStealer & KYCShadow Analysis

title: Suspicious PowerShell Command Line with MSI Download
id: 6a8b3c2d-1e4f-4b5a-9c6d-7e8f9a0b1c2d
description: Detects PowerShell commands downloading .msi files, a technique observed in ClickFix campaigns distributing Lumma Stealer.
status: experimental
date: 2026/05/01
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6523456789abcdef
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    category: process_creation
detection:
    selection_pwsh:
        Image|endswith: '\powershell.exe'
    selection_cli:
        CommandLine|contains: '.msi'
    selection_obfuscation:
        CommandLine|contains:
            - 'Invoke-Expression'
            - 'IEX'
            - 'DownloadString'
    condition: selection_pwsh and selection_cli and selection_obfuscation
falsepositives:
    - Legitimate software installation scripts
level: high
---
title: Node.js Spawning Native Windows Processes
id: 7b9c4d3e-2f5g-5h6i-0d7e-8f9a0b1c2d3e
description: Detects Node.js processes spawning suspicious native processes (e.g., cmd, powershell) indicative of LofyStealer loader activity.
status: experimental
date: 2026/05/01
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6523456789abcdg
tags:
    - attack.defense_evasion
    - attack.t1202
logsource:
    product: windows
    category: process_creation
detection:
    selection_parent:
        ParentImage|endswith: '\node.exe'
    selection_child:
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
            - '\rundll32.exe'
    filter_legit:
        CommandLine|contains: 'npm'
    condition: selection_parent and selection_child and not filter_legit
falsepositives:
    - Legitimate development tools running build scripts
level: medium
---
title: Network Connection to Infostealer C2 Domains
id: 8c0d5e4f-3h6i-6j7k-1e8f-9a0b1c2d3e4f
description: Detects network connections to domains associated with GhostSocks, KYCShadow, and TeamPCP campaigns.
status: experimental
date: 2026/05/01
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6523456789abcdh
tags:
    - attack.command_and_control
    - attack.t1071.001
logsource:
    product: windows
    category: network_connection
detection:
    selection:
        DestinationHostname|contains:
            - 'serv.biz'
            - 'serv.xyz'
            - 'api.biz'
            - 'retreaw.click'
            - 'aquasecurtiy.org'
    condition: selection
falsepositives:
    - Rare, but verify if similar legitimate domains exist in org environment
level: critical

// Hunt for Infostealer C2 Communications and Process Patterns
let IOCs_Domains = dynamic(['retreaw.click', 'serv.biz', 'serv.xyz', 'api.biz', 'aquasecurtiy.org']);
let IOCs_IPs = dynamic(['24.152.36.241', '85.11.161.198']);
let IOCs_Hashes = dynamic(['6cf223aea68b0e8031ff68251e30b6017a0513fe152e235c26f248ba1e15c92a', '293006cec43c663ccff331795d662c3b73b4d7af5f8584e2899e286c672c9881', 'd2a0d5f564628773b6af7b9c11f6b86531a875bd2d186d7081ab62748a800ebb']);

// Network Connections to C2
DeviceNetworkEvents
| where RemoteUrl in~ IOCs_Domains or RemoteIP in~ IOCs_IPs
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, RemotePort

// File Creation for Known Malware Hashes
DeviceFileEvents
| where SHA256 in~ IOCs_Hashes
| project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessAccountName

// Suspicious PowerShell Execution (ClickFix)
DeviceProcessEvents
| where ProcessVersionInfoOriginalFileName =~ 'PowerShell.EXE'
| where ProcessCommandLine contains '.msi' and (ProcessCommandLine contains 'IEX' or ProcessCommandLine contains 'DownloadString')
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName

# IOC Hunt Script for TeamPCP, LofyStealer, and KYCShadow Hashes
$MaliciousHashes = @(
    "6cf223aea68b0e8031ff68251e30b6017a0513fe152e235c26f248ba1e15c92a",
    "8395c3268d5c5dbae1c7c6d4bb3c318c752ba4608cfcd90eb97ffb94a910eac2",
    "d2a0d5f564628773b6af7b9c11f6b86531a875bd2d186d7081ab62748a800ebb",
    "97e073abd819d9cdc07705aeaa481f59",
    "3fcc7360a2738ad2656e17c7d4ed3e651ff7d73a",
    "d21a5d08b4614005c8fcd9d0068f0190",
    "fb203c0ac030a97281960d7c28d86ebf",
    "293006cec43c663ccff331795d662c3b73b4d7af5f8584e2899e286c672c9881",
    "45d4040e76a0d357dd6e236e185aba2eb82420d78640bfd1f3dede32b33931f7",
    "ddd2994acd25bde5ac32a03f1cf30b41",
    "3da35272ad6d280d3388d57bdbf61b9c"
)

$SearchPaths = @("C:\Windows\Temp", "C:\Users\", $env:TEMP)

Write-Host "[+] Scanning for known malicious file hashes..." -ForegroundColor Cyan

foreach ($Path in $SearchPaths) {
    if (Test-Path $Path) {
        Get-ChildItem -Path $Path -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
            $FileHash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($MaliciousHashes -contains $FileHash) {
                Write-Host "[!] MALICIOUS FILE FOUND: $($_.FullName)" -ForegroundColor Red
            }
        }
    }
}

Write-Host "[+] Scan complete." -ForegroundColor Green