Interlock, Rhysida & Gremlin Stealer: Converging Ransomware and Infostealer Operations — OTX Pulse Analysis

title: Suspicious PowerShell Obfuscation - Gremlin Stealer Loader
id: 1e2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
description: Detects obfuscated PowerShell commands often used by loaders like MintLoader or Gremlin Stealer to download payloads.
status: experimental
date: 2026/06/15
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/12345
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        Image|endswith: '\powershell.exe'
        CommandLine|contains:
            - 'FromBase64String'
            - 'IEX'
            - 'Invoke-Expression'
    condition: selection
falsepositives:
    - Legitimate administrative scripts
level: high
tags:
    - attack.execution
    - attack.t1059.001
---
title: Network Connection to Interlock/Rhysida C2 Infrastructure
id: 2f3c4d5e-6a7b-8c9d-0e1f-2a3b4c5d6e7f
description: Identifies connections to domains and IPs associated with Hive0163 and ShinyHunters C2.
status: experimental
date: 2026/06/15
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/12345
logsource:
    category: network_connection
detection:
    selection:
        DestinationHostname|contains:
            - 'leadslaw.com'
            - 'azurenetfiles.net'
    condition: selection
falsepositives:
    - Unknown
level: critical
tags:
    - attack.command_and_control
    - attack.t1071
---
title: Potential Webshell Activity - ShinyHunters MeshCentral
id: 3d4e5f6a-7b8c-9d0e-1f2a-3b4c5d6e7f8a
description: Detects suspicious process creation patterns associated with webshells or MeshCentral agent activity on web servers.
status: experimental
date: 2026/06/15
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/12345
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        ParentImage|contains:
            - '\w3wp.exe'
            - '\java.exe'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
    condition: selection
falsepositives:
    - System administration tasks
level: high
tags:
    - attack.persistence
    - attack.t1505.003


kql
// Hunt for connections to known malicious domains from OTX Pulses
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl in~ ("leadslaw.com", "azurenetfiles.net", "fifaticket2026vip.com")
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP

// Hunt for specific file hashes mentioned in pulses
DeviceFileEvents
| where Timestamp > ago(30d)
| where SHA256 in (
    "333903c7d22a27098e45fc64b77a264aa220605cfbd3e329c200d7e4b42c881c",
    "1bd0a200528c82c6488b4f48dd6dbc818d48782a2e25ccd22781c5718c3f62f5",
    "d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa",
    "c7e9332731b06644fc73e0046a2a89eaa59b09f54250e9bd622467187351711f",
    "2ab684d93c1553fad87041b4dea97188a97e78589deee2a7bacff905564f3a35"
)
| project Timestamp, DeviceName, FolderPath, SHA256, InitiatingProcessAccountName


powershell
<#
.SYNOPSIS
    IOC Hunt Script for OTX Pulse 2026-06-15
.DESCRIPTION
    Checks system for specific file hashes and registry artifacts associated with Interlock, Gremlin, and ShinyHunters.
#>

$TargetHashes = @(
    "333903c7d22a27098e45fc64b77a264aa220605cfbd3e329c200d7e4b42c881c",
    "1bd0a200528c82c6488b4f48dd6dbc818d48782a2e25ccd22781c5718c3f62f5",
    "d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa",
    "f0b3e112ce4807a28e2b5d66a840ed7f",
    "ebcf977806f68af3147e0b78b55f6aed"
)

function Get-FileHashByAlgorithm {
    param ([string]$Path)
    if (Test-Path $Path) {
        return (Get-FileHash -Path $Path -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
    }
    return $null
}

Write-Host "[+] Scanning common download directories for malicious files..."
$PathsToScan = @("$env:USERPROFILE\Downloads", "$env:TEMP", "C:\ProgramData")

foreach ($Path in $PathsToScan) {
    if (Test-Path $Path) {
        Get-ChildItem -Path $Path -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
            $Hash = Get-FileHashByAlgorithm -Path $_.FullName
            if ($Hash -in $TargetHashes) {
                Write-Host "[!] MALICIOUS FILE FOUND: $($_.FullName) | Hash: $Hash" -ForegroundColor Red
            }
        }
    }
}

Write-Host "[+] Checking Hosts file for C2 domains..."
$HostsPath = "$env:SystemRoot\System32\drivers\etc\hosts"
$MaliciousDomains = @("leadslaw.com", "azurenetfiles.net", "fifaticket2026vip.com")

if (Test-Path $HostsPath) {
    $Content = Get-Content $HostsPath
    foreach ($Domain in $MaliciousDomains) {
        if ($Content -match $Domain) {
            Write-Host "[!] POTENTIAL HOSTS FILE HIJACKING DETECTED: $Domain found in $HostsPath" -ForegroundColor Yellow
        }
    }
}

Write-Host "[+] Scan Complete."