IOCONTROL + MALPDB PLC Sabotage Campaign & Education Credential-Phishing Surge: OTX Pulse Analysis — Enterprise Detection Pack

---
title: Cyber Av3ngers C2 DNS Resolution - IOCONTROL/MALPDB Infrastructure
description: Detects DNS queries to known Cyber Av3ngers (IRGC-CEC) command-and-control or staging domains associated with the IOCONTROL and MALPDB malware families targeting U.S. PLC/OT environments.
status: experimental
logsource:
  category: dns
author: Security Arsenal Threat Intel
date: 2026/08/23
detection:
  selection:
    query|contains:
      - 'ocferda.com'
      - 'tylarion867mino.com'
  condition: selection
falsepositives:
  - Threat research or sandbox detonation
level: critical
tags:
  - attack.command_and_control
  - attack.t1071
---
title: Engineering Software Authenticating to PLC from Abnormal Host
description: Detects vendor engineering/HMI software (e.g., Unitronics, Siemens, Rockwell tooling) spawning from or authenticating via hosts outside the designated engineering workstation VLAN — a hallmark of Cyber Av3ngers valid-credential abuse against PLCs.
status: experimental
logsource:
  category: process_creation
  product: windows
author: Security Arsenal Threat Intel
date: 2026/08/23
detection:
  selection_img:
    Image|endswith:
      - '\VisiLogic.exe'
      - '\U90Ladder.exe'
      - '\TIA Portal.exe'
      - '\RSLogix500.exe'
      - '\Studio5000.exe'
  filter_authorized_hosts:
    WorkstationName|startswith:
      - 'ENG-WS-'
      - 'OT-ENG-'
  condition: selection_img and not filter_authorized_hosts
falsepositives:
  - Legitimate maintenance from non-standard jump hosts; tune the authorized-host filter to your naming convention
level: high
tags:
  - attack.initial_access
  - attack.t1078
  - attack.t0859
---
title: Education Sector Credential Phishing Domain Access
description: Detects web or DNS access to lookalike education/student-portal domains used in the back-to-school credential harvesting surge.
status: experimental
logsource:
  category: proxy
author: Security Arsenal Threat Intel
date: 2026/08/23
detection:
  selection:
    c-uri|contains:
      - 'checkmyschool.org'
      - 'education-gov.com'
      - 'studentdiscount.online'
      - 'studentloansyyyy.com'
      - 'students-portal.com'
  condition: selection
falsepositives:
  - Security research activity
level: high
tags:
  - attack.initial_access
  - attack.t1566

// Hunt: Cyber Av3ngers C2 + education phishing infrastructure across network and process telemetry
let OtC2 = dynamic(["ocferda.com", "tylarion867mino.com"]);
let EduPhish = dynamic(["checkmyschool.org", "education-gov.com", "studentdiscount.online", "studentloansyyyy.com", "students-portal.com"]);
let NetHits = DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where RemoteUrl in~ (union(OtC2, EduPhish))
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, ActionType
| extend IndicatorSet = iff(RemoteUrl in~ (OtC2), "OT-C2", "EDU-Phish");
let DnsHits = DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName =~ "svchost.exe" // noisy baseline, kept for completeness
| summarize count() by DeviceName;
let EngToolAnomaly = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where FileName has_any ("VisiLogic.exe", "U90Ladder.exe", "RSLogix500.exe", "Studio5000.exe")
| where DeviceName !startswith "ENG-WS-" and DeviceName !startswith "OT-ENG-"
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, AccountName, InitiatingProcessFileName;
union NetHits, EngToolAnomaly
| order by TimeGenerated desc

# Security Arsenal - OTX Pulse IOC Hunt (2026-08-23)
# Checks: malicious file hashes, C2/phishing domain connections, DNS cache residue
$ErrorActionPreference = 'SilentlyContinue'

$MalHashes = @(
    '95bd07b4400095acdafce05888da27228d7d07ca',
    '366e435a1ea0f597deb6ebe7c0c5acdb6e8b33eb',
    '325d5de03758e3850dfae33e509afee9',
    '6d0bd9615d730b0b828f7f91c346085f'
)
$BadDomains = @(
    'ocferda.com','tylarion867mino.com','checkmyschool.org',
    'education-gov.com','studentdiscount.online','studentloansyyyy.com','students-portal.com'
)

Write-Host '[*] 1/3 Scanning common staging paths for IOC file hashes...' -ForegroundColor Cyan
$Paths = @("$env:TEMP", "$env:ProgramData", "$env:APPDATA", 'C:\Users\Public')
foreach ($p in $Paths) {
    Get-ChildItem -Path $p -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
        $sha1 = (Get-FileHash -Path $_.FullName -Algorithm SHA1).Hash.ToLower()
        $md5  = (Get-FileHash -Path $_.FullName -Algorithm MD5).Hash.ToLower()
        if ($MalHashes -contains $sha1 -or $MalHashes -contains $md5) {
            Write-Host "[ALERT] IOC hash match: $($_.FullName) (SHA1: $sha1)" -ForegroundColor Red
        }
    }
}

Write-Host '[*] 2/3 Checking active connections and DNS cache for C2/phishing domains...' -ForegroundColor Cyan
$DnsCache = Get-DnsClientCache | Select-Object -ExpandProperty Entry
foreach ($d in $BadDomains) {
    if ($DnsCache -match [regex]::Escape($d)) {
        Write-Host "[ALERT] DNS cache hit for $d - host resolved malicious domain" -ForegroundColor Red
    }
    $conns = Get-NetTCPConnection -State Established | ForEach-Object {
        $ra = $_.RemoteAddress
        $resolved = (Resolve-DnsName -Name $d -ErrorAction SilentlyContinue | Select-Object -ExpandProperty IPAddress)
        if ($resolved -contains $ra) { $_ }
    }
    if ($conns) { Write-Host "[ALERT] Active connection to infrastructure resolving $d" -ForegroundColor Red }
}

Write-Host '[*] 3/3 Checking for rogue persistence (run keys + suspicious scheduled tasks)...' -ForegroundColor Cyan
$RunKeys = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
             'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run')
foreach ($rk in $RunKeys) {
    Get-ItemProperty -Path $rk | ForEach-Object {
        $_.PSObject.Properties | Where-Object { $_.Value -match 'TEMP|AppData|Public' } | ForEach-Object {
            Write-Host "[REVIEW] RunKey persistence candidate: $($_.Name) -> $($_.Value)" -ForegroundColor Yellow
        }
    }
}
Get-ScheduledTask | Where-Object { $_.TaskPath -notlike '\Microsoft*' -and $_.Actions.Execute -match 'AppData|Temp|Public' } | ForEach-Object {
    Write-Host "[REVIEW] Suspicious scheduled task: $($_.TaskName) -> $($_.Actions.Execute)" -ForegroundColor Yellow
}
Write-Host '[*] Hunt complete. Escalate any ALERT findings to IR immediately.' -ForegroundColor Green