Three concurrent OTX pulses paint a picture of a threat landscape dominated by espionage-grade tradecraft migrating into criminally monetizable operations.
JadeProx (China-nexus) was exposed through a classic OPSEC failure: an open directory on an Alibaba Cloud server revealed the operator's full toolkit — the TriBack Loader, AdaptixC2 framework, PlugX/Korplug (S0013), Sogu, DestroyRAT, Beagle, Thoper, TVT, and XMRig cryptominers. Simultaneous intrusions were confirmed against Vietnamese hospitals, the Malaysian Ministry of Foreign Affairs, Hong Kong educational institutions, and targets in Honduras. The initial access vector combines phishing with exploitation of CVE-2021-31755 and CVE-2021-32305 (TOTOLINK/firmware-class and related vulnerabilities), alongside older CVEs (CVE-2018-11511, CVE-2021-24139) suggesting opportunistic edge-device and plugin exploitation.
Void Blizzard / LAUNDRY BEAR (CL-STA-1114, Russian-nexus) is running a global webmail espionage campaign against Zimbra Collaboration Suite. The campaign abuses CVE-2025-66376 in a zero-click phishing model — a victim merely viewing a crafted email triggers JavaScript injection inside the authenticated webmail session, enabling mail theft, credential harvesting, and persistent mailbox surveillance. Targets span government, defense, transportation, and finance across NATO states, Ukraine, CIS countries, and Africa. Supporting infrastructure spoofs Zimbra analytics and telemetry themes (zimbra-metadata.com, zimbrastat.com, zimbrasoft.com.ua).
Helix (data extortion) is the newest brand likely spun out of the BlackFile/ShinyHunters ecosystem after BlackFile's April 2026 shutdown. Helix skips ransomware entirely: it uses vishing (impersonating named managers), device code phishing against Microsoft Entra ID, MFA abuse, and automated SharePoint exfiltration — then extorts on the stolen data. The lone indicator oskeysync.com fronts the phishing flow.
Collectively: one state-nexus intrusion set caught by its own OPSEC mistake, one Russian espionage operation industrializing zero-click webmail compromise, and one extortion crew proving identity — not malware — is now the primary perimeter.
Threat Actor / Malware Profile
JadeProx Toolkit
- Distribution: Spear phishing plus exploitation of CVE-2021-31755 / CVE-2021-32305 against exposed appliances; post-exploitation delivery of TriBack Loader.
- Payload behavior: TriBack stages second payloads — PlugX/Korplug (S0013) for long-haul espionage, Sogu for lateral collection, DestroyRAT for destructive/remote control capability, XMRig for resource theft monetization. AdaptixC2 (an open-source C2 framework increasingly favored by China-nexus operators) provides modular post-exploitation.
- C2: Infrastructure hosted on Alibaba Cloud; the open directory that broke the campaign contained operator tooling, configs, and victim logs — indicating infrastructure reuse across victims.
- Persistence: PlugX variants classically use DLL side-loading via signed legitimate binaries and registry Run keys; AdaptixC2 supports service and scheduled-task persistence.
- Anti-analysis: Korplug's encrypted payload blobs, side-loading through trusted signed executables, and loader-to-payload separation frustrate static detection and sandbox detonation.
Void Blizzard / LAUNDRY BEAR (CL-STA-1114)
- Distribution: Zero-click phishing emails targeting Zimbra webmail; no attachment, no click required — rendering the message executes the exploit chain.
- Payload behavior: Exploitation of CVE-2025-66376 yields JavaScript injection within the victim's authenticated webmail context, granting mailbox read access, session token theft, and credential capture.
- C2: Themed look-alike domains impersonating Zimbra analytics/statistics services (
zimbra-metadata.com,mailnalysis.com,analyticemailmeter.com,zimbrastat.com,zimbrasoft.com.ua,emailanalytics.com.ua,istc-cloud.com). - Persistence: Mailbox-level — injected scripts and harvested session tokens survive password-independent access windows; forwarding rules and OAuth grants are typical follow-on persistence in webmail espionage.
- Anti-analysis: Server-side exploit delivery leaves minimal host artifacts; JavaScript is fetched from rotating themed domains.
Helix
- Distribution: Pure identity attacks — vishing calls impersonating named internal managers, driving victims to device code phishing flows (Microsoft OAuth device authorization grant).
- Payload behavior: No traditional malware. Compromised sessions drive automated SharePoint/OneDrive mass exfiltration.
- C2 / infrastructure:
oskeysync.comfronts the phishing kit. - Persistence: Consented OAuth tokens and abused MFA sessions; extortion leverage replaces dwell time.
- Anti-analysis: Living-off-the-cloud — no binaries to sandbox, no hashes to block.
IOC Analysis
The pulses provide three distinct indicator classes requiring different handling:
- File hashes (JadeProx): MD5
b8053bcd04ce9d7d19c7f36830a9f26b, SHA13ba9a74f8faeff3de03e4c834f266582e2eb46a8, SHA256e82ecbe3823046a27d8c39cc0a4acb498f415549946c9ff0e241838b34ed5a21. Push SHA256/SHA1 into EDR blocklists and VirusTotal Enterprise retrohunts; MD5 is legacy but useful for matching older tooling in forensic images. - Domains: Eight webmail-themed Void Blizzard domains plus JadeProx's
sylverixstrategy.comand Helix'soskeysync.com. These are high-fidelity — sinkhole or DNS-block immediately, and add to proxy/Secure Web Gateway categories. Run passive DNS (SecurityTrails, PassiveTotal, Validin) to expand infrastructure by shared registrant, certificate, and nameserver overlap. - CVEs: CVE-2025-66376 (Zimbra — patch priority one for any exposed Zimbra), CVE-2021-31755 / CVE-2021-32305 (edge/firmware devices in JadeProx's initial access), CVE-2018-11511 and CVE-2021-24139 (legacy — indicates unpatched estate is being swept opportunistically).
SOC operationalization: ingest all indicators into your TIP (OpenCTI, MISP), set 90-day expiry on domains, feed hashes to EDR, and correlate DNS query logs retroactively 90 days for the themed domains. For Helix, indicators are nearly irrelevant — detection must be behavioral (sign-in and exfiltration analytics).
Detection Engineering
YAML
---
title: PlugX Korplug DLL Side-Loading via Signed Binary
description: Detects legitimate signed executables loading DLLs from non-standard paths, consistent with PlugX/Korplug side-loading observed in the JadeProx campaign.
status: experimental
logsource:
category: image_load
product: windows
author: Security Arsenal
date: 2026/08/22
references:
- https://www.group-ib.com/blog/jadeprox-china-nexus-triback-loader/
detection:
selection_signed:
Signed: 'true'
filter_system_paths:
ImageLoaded|startswith:
- 'C:\Windows\System32\'
- 'C:\Windows\SysWOW64\'
- 'C:\Program Files\'
- 'C:\Program Files (x86)\'
selection_suspicious_dll:
ImageLoaded|endswith:
- '.dat'
- '.tmp'
condition: selection_signed and selection_suspicious_dll and not filter_system_paths
falsepositives:
- Legitimate software loading data files
tags:
- attack.defense_evasion
- attack.t1574.002
level: medium
---
title: Zimbra Themed C2 Domain Resolution - Void Blizzard
description: Detects DNS resolution of Void Blizzard / LAUNDRY BEAR themed webmail espionage infrastructure identified in OTX pulse Global Webmail Espionage.
status: experimental
logsource:
category: dns
author: Security Arsenal
date: 2026/08/22
references:
- https://unit42.paloaltonetworks.com/russian-webmail-espionage/
detection:
selection:
query|contains:
- 'zimbra-metadata.com'
- 'emailanalytics.com.ua'
- 'mailnalysis.com'
- 'analyticemailmeter.com'
- 'zimbrastat.com'
- 'zimbrasoft.com.ua'
- 'istc-cloud.com'
- 'sylverixstrategy.com'
- 'oskeysync.com'
condition: selection
falsepositives:
- Unlikely; domains are adversary-controlled
tags:
- attack.command_and_control
- attack.t1071.001
level: high
---
title: Microsoft Device Code Phishing Authentication - Helix
description: Detects device code flow sign-ins from unusual sources, consistent with Helix vishing-driven device code phishing leading to SharePoint exfiltration.
status: experimental
logsource:
product: azure
service: signinlogs
author: Security Arsenal
date: 2026/08/22
references:
- https://reliaquest.com/blog/threat-spotlight-helix-new-name-in-data-extortion-ecosystem
detection:
selection:
authentication_protocol|contains: 'deviceCode'
condition: selection
falsepositives:
- Legitimate CLI tooling (Azure CLI, Graph PowerShell) on managed devices
tags:
- attack.initial_access
- attack.t1566
- attack.t1528
level: high
KQL — Microsoft Sentinel / Defender
// Hunt: Void Blizzard Zimbra C2 + JadeProx/Helix infrastructure + PlugX side-loading artifacts
let apt_domains = dynamic(["zimbra-metadata.com","emailanalytics.com.ua","mailnalysis.com","analyticemailmeter.com","zimbrastat.com","zimbrasoft.com.ua","istc-cloud.com","sylverixstrategy.com","oskeysync.com"]);
let net = DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemoteUrl in~ (apt_domains)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, ActionType;
let dns = DeviceEvents
| where TimeGenerated > ago(30d)
| where ActionType == "DnsQueryResponse"
| where AdditionalFields has_any (apt_domains)
| project TimeGenerated, DeviceName, ActionType, AdditionalFields;
let sideload = DeviceImageLoadEvents
| where TimeGenerated > ago(30d)
| where FileName endswith ".dat" or FileName endswith ".tmp"
| where FolderPath !startswith "C:\\Windows\\"
| project TimeGenerated, DeviceName, FileName, FolderPath, InitiatingProcessFileName, SHA256;
union net, dns, sideload
| sort by TimeGenerated desc
PowerShell
# Security Arsenal - JadeProx / Void Blizzard / Helix IOC Hunt Script
# Run on endpoints; requires elevated rights for scheduled task enumeration.
$domains = @("zimbra-metadata.com","emailanalytics.com.ua","mailnalysis.com",
"analyticemailmeter.com","zimbrastat.com","zimbrasoft.com.ua",
"istc-cloud.com","sylverixstrategy.com","oskeysync.com")
$hashes = @("e82ecbe3823046a27d8c39cc0a4acb498f415549946c9ff0e241838b34ed5a21")
Write-Host "=== [1] DNS Cache Check for APT C2 Domains ===" -ForegroundColor Cyan
$dnsCache = Get-DnsClientCache -ErrorAction SilentlyContinue
foreach ($d in $domains) {
$hit = $dnsCache | Where-Object { $_.Entry -like "*$d*" }
if ($hit) { Write-Host "[!] DNS cache hit: $d" -ForegroundColor Red; $hit | Format-Table }
}
Write-Host "=== [2] Active Connections to Suspicious Hosts ===" -ForegroundColor Cyan
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
Where-Object { $_.RemoteAddress -notmatch "^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.)" } |
ForEach-Object {
$proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
[PSCustomObject]@{ RemoteIP=$_.RemoteAddress; Port=$_.RemotePort; Process=$proc.ProcessName; Path=$proc.Path }
} | Sort-Object RemoteIP -Unique | Format-Table -AutoSize
Write-Host "=== [3] PlugX Persistence: Run Keys & Services ===" -ForegroundColor Cyan
$runKeys = @("HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
"HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
"HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run")
foreach ($k in $runKeys) {
if (Test-Path $k) {
Get-ItemProperty $k | ForEach-Object {
$_.PSObject.Properties | Where-Object { $_.Value -match "appdata|temp|programdata|\.dat" } |
ForEach-Object { Write-Host "[!] Suspicious Run key: $($_.Name) = $($_.Value)" -ForegroundColor Red }
}
}
}
Write-Host "=== [4] Scheduled Tasks Launching from User-Writable Paths ===" -ForegroundColor Cyan
Get-ScheduledTask | ForEach-Object {
$actions = $_.Actions | Where-Object { $_.Execute -match "appdata|temp|programdata" }
if ($actions) { Write-Host "[!] Task: $($_.TaskName) -> $($actions.Execute)" -ForegroundColor Red }
}
Write-Host "=== [5] Hash Sweep in Common Staging Directories ===" -ForegroundColor Cyan
$paths = @("$env:TEMP","$env:APPDATA","C:\ProgramData")
foreach ($p in $paths) {
Get-ChildItem $p -Recurse -File -ErrorAction SilentlyContinue |
ForEach-Object {
$h = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
if ($hashes -contains $h.ToLower()) { Write-Host "[!!!] JadeProx hash match: $($_.FullName)" -ForegroundColor Red }
}
}
Write-Host "=== Hunt Complete. Review [!] findings and escalate to IR if confirmed. ===" -ForegroundColor Green
Response Priorities
Immediate (0–24h)
- Block all 10 domains at DNS, proxy, and EDR network layers; sinkhole where possible to identify compromised hosts.
- Patch Zimbra against CVE-2025-66376 on any internet-facing instance; if patching is delayed, restrict webmail access to VPN-only.
- Push the JadeProx SHA256/SHA1/MD5 to EDR blocklists; run the hash sweep above on internet-facing and clinical/administrative systems.
- Retro-hunt DNS and proxy logs 90 days for all listed domains; any hit is a confirmed-compromise escalation, not a false positive.
24 Hours
- Helix exposure is identity exposure: audit Entra ID sign-in logs for device code flow authentications, anomalous OAuth consent grants, and new MFA registrations. Revoke all refresh tokens for any user flagged.
- Audit Zimbra mailboxes for unauthorized forwarding rules, delegate access, and unusual session geographies (Void Blizzard persistence).
- For any host with JadeProx hash or domain hits: assume credential theft (PlugX harvests broadly) — force resets and isolate pending forensic imaging.
- Contact vishing-awareness channels: brief help desk and executive assistants on manager-impersonation vishing driving device code entry.
1 Week
- Segment and inventory edge/firmware devices exposed to CVE-2021-31755 / CVE-2021-32305; retire or isolate unpatchable appliances (JadeProx's initial access).
- Disable the OAuth device code flow tenant-wide unless explicitly required; enforce Conditional Access with compliant-device and phishing-resistant MFA (FIDO2) for SharePoint/OneDrive access.
- Deploy SharePoint mass-download / mass-access anomaly detection (throttling alerts, unusual egress volume per user) to catch Helix-style automated exfiltration.
- Add DLL side-loading detection coverage for signed-binary + non-standard-path loads across the estate; validate the Sigma rules above in your SIEM.
Related Resources
Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.