Interlock & DragonForce Campaign: C2 Obfuscation via MSTeams and Stealer Delivery

---
title: Potential Steam Wallpaper Engine Malicious Spawning
id: 3f8b5c2e-1a9b-4c3d-9e5f-6a7b8c9d0e1f
description: Detects suspicious processes spawned by Steam Wallpaper Engine, a known vector for Vidar and Lumma delivery.
status: experimental
date: 2026/06/17
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/66545b2c1e0409586c19a2f9
tags:
    - attack.execution
    - attack.t1204
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\wallpaper32.exe'
    filter_legit:
        Image|endswith:
            - '\wallpaper32.exe'
            - '\steamwebhelper.exe'
            - '\gameoverlayui.exe'
    condition: selection and not filter_legit
falsepositives:
    - Legitimate third-party wallpaper tools (rare)
level: high
---
title: DragonForce Backdoor.Turn Teams Relay Traffic
id: a1b2c3d4-5678-90ef-ghij-klmnopqrstuv
description: Detects potential Backdoor.Turn C2 traffic leveraging Microsoft Teams TURN servers by non-Microsoft processes.
status: experimental
date: 2026/06/17
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/66545b2c1e0409586c19a2f9
tags:
    - attack.command_and_control
    - attack.t1071.001
logsource:
    category: network_connection
    product: windows
detection:
    selection_dst:
        DestinationHostname|contains:
            - 'relay.microsoft.com'
            - 'teams.microsoft.com'
    selection_port:
        DestinationPort: 443
    filter_legit:
        Image|contains:
            - '\Teams.exe'
            - '\Microsoft.Teams.exe'
            - '\msteams.exe'
    condition: selection_dst and selection_port and not filter_legit
falsepositives:
    - Other legitimate Office 365 apps communicating via custom endpoints
level: critical
---
title: Interlock Rhysida JunkFiction Downloader Activity
id: b2c3d4e5-6789-01fg-hijk-lmnopqrstuvw
description: Detects execution patterns associated with JunkFiction downloader or InterlockRAT installers.
status: experimental
date: 2026/06/17
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/66545b2c1e0409586c19a2f9
tags:
    - attack.initial_access
    - attack.t1566.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\msiexec.exe'
            - '\rundll32.exe'
            - '\regsvr32.exe'
    selection_cli:
        CommandLine|contains:
            - 'http://'
            - 'ftp://'
    selection_network:
        CommandLine|contains:
            - '/i'
            - 'javascript:'
    condition: all of selection_*
falsepositives:
    - Legitimate software installation
level: medium

// Hunt for DragonForce Teams Relay abuse and Steam Wallpaper Malware
// Search for non-Microsoft processes contacting Teams infrastructure
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any ("relay.microsoft.com", "teams.microsoft.com") 
| where InitiatingProcessName !has "Teams.exe" and InitiatingProcessName !has "msteams.exe"
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessName, RemoteUrl, RemotePort

// Hunt for Steam Wallpaper Engine spawning suspicious payloads
DeviceProcessEvents
| where Timestamp > ago(30d)
| where InitiatingProcessFileName == "wallpaper32.exe"
| where not(ActionType in ("Process creation", "Process created")) // Adjust based on schema specifics
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName

// Hunt for specific IOCs (File Hashes)
DeviceFileEvents
| where Timestamp > ago(7d)
| where SHA256 in (
    "333903c7d22a27098e45fc64b77a264aa220605cfbd3e329c200d7e4b42c881c",
    "8a4033425d36cd99fe23e6faef9764fbf555f362ebdb5b72379342fbbe4c5531",
    "1bd0a200528c82c6488b4f48dd6dbc818d48782a2e25ccd22781c5718c3f62f5",
    "fc586cad94e5a10dd5be6a6ae6096bd02dfbfd094365bec87e788ed0798d6f67"
)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256

# IOC Hunter for Interlock, DragonForce, and Steam Malware Campaigns
# Checks for the presence of specific file hashes and suspicious processes.

$TargetHashes = @(
    "333903c7d22a27098e45fc64b77a264aa220605cfbd3e329c200d7e4b42c881c", # InterlockRAT
    "1bd0a200528c82c6488b4f48dd6dbc818d48782a2e25ccd22781c5718c3f62f5", # Gremlin Stealer
    "8a4033425d36cd99fe23e6faef9764fbf555f362ebdb5b72379342fbbe4c5531", # Backdoor.Turn
    "fc586cad94e5a10dd5be6a6ae6096bd02dfbfd094365bec87e788ed0798d6f67"  # Steam Malware
)

$SuspiciousProcesses = @("wallpaper32.exe") # Parent process for Steam malware

Write-Host "[*] Starting Scan for IOCs..." -ForegroundColor Cyan

# 1. Scan fixed drives for file hashes
Write-Host "[*] Scanning file system for known malicious hashes..." -ForegroundColor Yellow
Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue | 
    Where-Object { !$_.PSIsContainer -and $_.Length -gt 0kb } | 
    ForEach-Object {
        $file = $_
        $hash = (Get-FileHash -Path $file.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
        if ($TargetHashes -contains $hash) {
            Write-Host "[!] MALICIOUS FILE FOUND: $($file.FullName) | Hash: $hash" -ForegroundColor Red
        }
    }

# 2. Check for active processes related to Steam Wallpaper Engine acting as parents
Write-Host "[*] Checking for suspicious process chains..." -ForegroundColor Yellow
$processes = Get-WmiObject Win32_Process | Where-Object { $SuspiciousProcesses -contains $_.Name }
if ($processes) {
    foreach ($proc in $processes) {
        Write-Host "[!] Suspicious Parent Process Found: $($proc.Name) (PID: $($proc.ProcessId))" -ForegroundColor Yellow
        Get-WmiObject Win32_Process | Where-Object { $_.ParentProcessId -eq $proc.ProcessId } | 
            ForEach-Object { 
                Write-Host "    -> Child Process: $($_.Name) (PID: $($_.ProcessId)) Command: $($_.CommandLine)" -ForegroundColor Red
            }
    }
} else {
    Write-Host "[+] No suspicious Wallpaper Engine processes detected." -ForegroundColor Green
}

# 3. Network Connection Check (DragonForce Teams Relay)
Write-Host "[*] Checking for connections to Teams Relay infrastructure..." -ForegroundColor Yellow
$connections = Get-NetTCPConnection | Where-Object { 
    $_.RemoteAddress -ne "0.0.0.0" -and 
    $_.State -eq "Established"
}

if ($connections) {
    foreach ($conn in $connections) {
        try {
            $proc = Get-Process -Id $conn.OwningProcess -ErrorAction Stop
            # Resolve hostname to check if it is Microsoft related
            # Note: DNS resolution can be slow; this is a basic check
            if ($proc.ProcessName -notmatch "Teams|msteams|outlook") {
                 # Deep packet inspection not available in PS, but we check if the process is unexpected for a standard corporate environment usually talking to MS infrastructure
                 if ($conn.RemotePort -eq 443) {
                    Write-Host "[!] Potential C2: Process $($proc.ProcessName) connected to $($conn.RemoteAddress):$($conn.RemotePort)" -ForegroundColor DarkYellow
                 }
            }
        } catch {
            # Ignore access errors
        }
    }
}